CVE-2011-4681: Opera Browser

Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days.

Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to a different domain name in the same top-level domain, as demonstrated by the .no or .uk domain.

Affected products

• Opera Opera Browser: up to and including 11.60; version 5.0 only; version 5.02 only; version 5.10 only; version 5.11 only; version 5.12 only; …

Published 2011-12-07. Last modified 2026-06-16.