A critical vulnerability in Opera GX that allowed attackers to exfiltrate sensitive user data, including Gmail addresses, from any website simply by having a victim visit a malicious page.
The flaw, patched by Opera on May 8, 2026, required no user interaction, no JavaScript execution, and no traditional bug to exploit.
The vulnerability stems from Opera GX’s “GX Mods” feature, which lets users customize browser appearance, sounds, and website styling via CSS.
Opera GX Universal CSS Injection Flaw
Rachid Allam found that mods packaged as .crx files install automatically upon download, without any permission prompt, when a victim visits a site that embeds an iframe pointing to the file.
This install primitive was previously flagged in 2023 by researcher Renwa, who used it for address bar spoofing, a bug Opera patched at the time without addressing the underlying auto-install behavior.
The new research revealed that a GX Mod’s CSS is applied globally across every tab and webpage the victim visits, not just a single page.
This transforms a seemingly harmless customization feature into a universal CSS injection vector with far broader reach than , which are usually confined to a single page’s DOM.
Since Opera stripped @import support in modified stylesheets, the researchers couldn’t use standard CSS exfiltration chaining techniques (attribute selectors like [value^="A"] triggering conditional network requests).
Instead, they engineered a brute-force approach using trigram-based attribute selectors (content^=, content*=, content$=) combined with CSS variables to avoid cascade collisions, a technique inspired by Gareth Heyes’ blind CSS exfiltration work.
Targeting Google’s account page (myaccount.google.com/contactemail), they generated a 151,959-rule stylesheet capable of exfiltrating every 3-character sequence of a victim’s Gmail address via covert network requests to an attacker-controlled server.
To keep the browser from crashing under the CSS load, they split exfiltration across multiple HTML attributes and divided variable (--slot1, --slot2) consumption across separate DOM elements.
A custom depth-first search reconstruction algorithm then reassembled the full email address from the leaked trigrams, accounting for repeated substrings via a “budget” system.
By pairing the auto-install primitive with a short JavaScript timer that redirects the victim to the target page immediately after mod installation, the attack required zero clicks and no visible warning beyond a dismissible notification bar.
The same automatic .crx handling also enabled a separate . Visiting a .crx file directly in Incognito mode forced Opera into an invalid extension-installation state, causing the browser to crash and restart.
, this crash vector affected both Opera GX and Opera because any file ending in .crx triggered the extension installation pipeline regardless of its actual contents.
Opera fixed the vulnerability before public disclosure. The bug was reported through Opera’s Bugcrowd program on February 16, 2026, initially triaged as P3, and later reclassified by Opera’s security team as P1 after full exploitation details were demonstrated.
The issue was patched on May 8, 2026, and the researchers received the maximum critical bounty of $5000.
The findings underscore how “harmless” browser customization features can become powerful cross-site attack surfaces when they are auto-installed and applied globally.
Even without JavaScript or elevated extension permissions, attacker-controlled CSS was sufficient to build a zero-click browser-wide data exfiltration channel.
Follow us on , and to Get More Instant Updates. Set Cyberpress as a Preferred Source in .