Opera bug bounty programs
opera.com Updated
Opera runs two public programs: a Bugcrowd bug bounty paying up to $10,000 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $10,000
- Bugcrowd
- Programs
- 2
- 1 pays cash
- Targets in scope
- 89
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Opera Public Bug Bounty
Bugcrowd · Pays the most of the 2 programs: up to $10,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Opera Public Bug Bounty
Bugcrowd · Bug bounty |
$5,000 (highest) | $3,000 (highest) | $500 (highest) | $200 (highest) | $10,000 | Full | – | – | Open |
|
Opera
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | – | Open |
-
- Critical
- $5,000 (highest)
- High
- $3,000 (highest)
- Medium
- $500 (highest)
- Low
- $200 (highest)
- Safe harbor
- Full
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
89 targets across all 2 programs, each listed once with the programs that cover it. 22 excluded.
-
https://www.opera.com/computer/thanks?ni=opera_air&os=windows
Products and areas
Covered by Bugcrowd
No target matches. Try part of a host name, such as the company name.
Out of scope 22
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
107.167.127.4{0,1}
Bugcrowd
-
32s.opera.com
Bugcrowd
-
accountsstage.yoyogames.com
Bugcrowd
-
admanager.opera.com
Bugcrowd
-
bugs.yoyogames.com
Bugcrowd
-
catch.opera.com
Bugcrowd
-
certs.opera.com
Bugcrowd
-
checkout.opera.com
Bugcrowd
-
concurso.opera.com
Bugcrowd
-
contest.opera.com
Bugcrowd
-
control.gx-servers.opera.com
Bugcrowd
-
help.gx-servers.opera.com
Bugcrowd
-
help.yoyogames.com
Bugcrowd
-
investor.opera.com
Bugcrowd
-
jobs.opera.com
Bugcrowd
-
s2{1,2}-05-08-v09.opera-mini.net
Bugcrowd
-
tabfulness.opera.com
Bugcrowd
-
verizon-us-lvs-ashburn.opera-mini.net
Bugcrowd
-
verizon-us-lvs-seattle.opera-mini.net
Bugcrowd
-
verizon-us-seattle.opera-mini.net
Bugcrowd
-
wallpaper.opera.com
Bugcrowd
-
interstitial.opera-mini.net
Bugcrowd
Recent changes
Reward and scope changes across every Opera program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Opera products, from the NVD.
-
CVE-2018-16135 Medium
The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site.
-
CVE-2018-16135 Medium
The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site.
-
CVE-2021-23253 Medium
Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains an
-
CVE-2021-23253 Medium
Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains an
-
CVE-2020-6159 Medium
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
-
CVE-2020-6159 Medium
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
-
CVE-2020-6157 Medium
Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing sensitive data.
-
CVE-2020-6157 Medium
Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing sensitive data.
About this page
This page gathers every public program listed under opera.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.