Opera Browser (com.opera.browser): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Opera Browser.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Opera Browser
NASDAQ
2026-06-25
90d ago
Engaged
High
Opera is majority owned by a Chinese company, which means Chinese law can reach the browsing data Opera collects, yet Opera markets itself specifically as a privacy browser. Opera answered technical points twice but never directly answered whether its DPO knew, whether a valid data-transfer safeguard exists, or when the Chinese ad SDK would be removed, so this case closes with those three questions still open.
Majority-owned by Beijing Kunlun Tech (CN, roughly 68-72% per SEC filings): Chinese NSL applies to all browsing data reachable by the compiled ByteDance/Pangle ad SDK, CVSS v4.0 base MEDIUM/6.9, held at HIGH under blast-radius escalation given the browser's very large user base. Dual pre-consent ad init pipeline fires before first launch, corrected in this report to MEDIUM/6.9 CVSS. Marketed as "privacy browser" with a Chinese controller. Opera engaged twice with technical substance (11 August and 23 September 2026) and answered none of the three original yes/no questions either time, Pattern P-10, the Substituted Question, the clearest repeat instance of this pattern in the campaign. Opera also correctly identified and RFI-IRFOS accepted a factual error in the original disclosure: Qihoo 360 sold its full stake back to Opera in October 2022 and is no longer a shareholder, narrowing this finding to Kunlun Tech alone. Case closed and published 2026-09-23, on the original embargo date.
click to expand
GDPR Art. 44-49GDPR Art. 7GDPR Art. 32+2
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.