Executive Summary
Security researchers identified a critical vulnerability in Opera GX (and to a lesser extent, standard Opera) stemming from the automatic, no-prompt installation of GX Mods. By embedding a hidden iframe pointing to a malicious .crx file, an attacker can silently install a 'Mod' that applies custom CSS to every website the user visits. This 'Universal CSS Injection' can be weaponized as an XS-Leak to exfiltrate sensitive information, such as Gmail addresses or usernames, by brute-forcing character sequences using CSS attribute selectors.
The attack is particularly dangerous because it requires zero user interaction beyond visiting a malicious site and can occur before a user has time to react to the minor notification bar indicating a new mod was added. Furthermore, the same vector can be used to trigger a browser-wide denial-of-service (DoS) when exploited in Incognito mode. Opera has since patched these issues in version 130.0.5847.89, and while no evidence of exploitation in the wild exists, the severity was rated P1 due to the zero-click nature of the data theft.
For organizations, this highlights the risk of 'cosmetic' browser features that lack robust permission boundaries. Impacted users should ensure their Opera GX browsers are updated to the latest version to mitigate the risk of cross-site data exfiltration.