CVE-2009-2351: Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows r...

Security readout for executives and security teams

This is a legacy Opera browser XSS issue. Older Opera builds could treat a Refresh response header containing a script URI as executable content. A malicious or compromised site able to control that header could run script in the browser context. The supplied sources do not identify active exploitation, CVSS scoring, or a named patch. Exposure is most plausible where users still run obsolete Opera desktop builds, especially Opera 9.52 or earlier, or the cited 10.00 beta build. Modern browser fleets are unlikely to be materially exposed, but legacy kiosk, lab, or unmanaged workstation environments should be checked. Treat this as a legacy exposure cleanup item, not an emergency, unless the organization still depends on old Opera installations. The business action is to identify and remove unsupported browsers that can turn ordinary web content into client-side script execution risk. Mitigation focus: Inventory endpoints for legacy Opera 9.x and 10.00 beta usage.; Retire unsupported Opera builds and move users to maintained browsers.; Check Opera or vendor guidance for the fixed release before granting exceptions..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.