Researchers found a flaw in Opera GX — the gaming-focused browser — that let a malicious website silently install a browser add-on and lift data from pages the victim visits.
In their proof of concept, they reconstructed a signed-in user’s full Gmail address from a single visit. Zero clicks needed. Opera patched the flaw in version 130.0.5847.89 and says there’s no evidence it was ever exploited in the wild. No CVE was assigned.
Here’s how it worked. Opera GX lets you install “Mods” — custom skins with sounds, themes, and CSS that restyles sites you visit. They ship as .crx files, like extensions, but can’t run JavaScript. The issue: Opera’s mod pipeline downloads and enables them automatically, no approval prompt. A malicious page can silently install one via a hidden iframe pointed at a .crx file.
The only sign is a notification bar below the address bar with a Remove button. The researcher’s redirect runs in the seconds before a user can even read that notice.
This auto-install behavior isn’t new. Researcher Renwa flagged the same mechanism back in 2023. Opera patched that specific attack but left the underlying auto-install in place.
A mod’s CSS applies to every page you visit — what researchers call universal CSS injection. CSS can’t read a page and send data off on its own, but it can be coaxed into leaking values character by character using attribute selectors and background-image requests. For the Gmail proof of concept, they used 150,000 CSS rules targeting three-letter trigrams from the account page’s HTML attributes.
Opera’s bug bounty team initially rated this P3 (medium). The researchers proved their point by catching the analyst’s own trigrams during reproduction, reconstructing their Gmail address, and pasting it into the report. Severity was raised to P1. They got the maximum $5,000 payout.
You’re protected if you’re on Opera GX 130.0.5847.89 or later. No workaround existed short of the patch.
