Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages
Summary: Researchers found a flaw in Opera GX that let a malicious website silently auto-install a mod and use its CSS, applied to every page the browser opens, to leak data such as a full Gmail address reconstructed from a single visit with no click. Opera patched it in Opera GX version 130.0.5847.89, rated the issue P1, paid the $5,000 maximum critical-bug bounty, and said it found no evidence of exploitation in the wild.
Key Takeaway: The attack needed no clicks or approvals, and the researchers rebuilt a signed-in user's full Gmail address in the seconds before the removal notice could even be read. Opera had known about the underlying auto-install behavior since researcher Renwa identified it in 2023 and patched only that specific attack, leaving the install path in place.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026