A newly disclosed vulnerability in Opera GX allowed attackers to silently exfiltrate sensitive user data with no interaction required, simply by luring victims to a malicious website<\/a>.<\/p>\n The issue, documented in recent research titled \u201cOne trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX),\u201d highlights how a seemingly harmless browser customization feature can be weaponized for large-scale data theft.<\/p>\n The root cause lies in Opera GX\u2019s \u201cGX Mods\u201d feature, which enables users to customize browser appearance using packaged files.<\/p>\n These mods, distributed as .crx files, are automatically installed when downloaded, without requiring explicit user permission.<\/p>\n Researchers discovered that attackers could exploit this behavior by embedding a malicious .crx file inside a webpage. When a victim visits the page, the mod installs silently in the background.<\/p>\n Unlike traditional browser extensions, GX Mods do not support JavaScript or request permissions. However, they can inject CSS across all websites visited by the user.<\/p>\n This capability became the foundation of the attack, enabling a cross-site leak (XS-Leak)<\/a> via universal CSS injection.<\/p>\n CSS-based attacks cannot directly read sensitive data, but they can infer it by triggering network requests.<\/p>\n For example, carefully crafted CSS selectors can detect whether certain values exist in a webpage\u2019s HTML and conditionally load external resources. Each triggered request leaks a small piece of information to an attacker-controlled server.<\/p>\n In this case, the researchers designed a large-scale CSS payload capable of extracting data one fragment at a time.<\/p>\n They focused on reconstructing a victim\u2019s Gmail address by breaking it into smaller segments called trigrams, which are sequences of three characters.<\/p>\n By generating thousands of CSS rules that test for different trigram combinations, the attack could identify which fragments are present in the target data.<\/p>\n To avoid limitations in CSS processing, the researchers used advanced techniques such as CSS variables and multi-layered background requests.<\/p>\n These methods allowed multiple data points to be exfiltrated simultaneously without being overridden by CSS cascading rules<\/a>. The attack also distributed the workload across different HTML elements to prevent browser crashes.<\/p>\n Once the victim is redirected to a target page, such as a Google account page containing their email address, the injected CSS begins probing for matching patterns.<\/p>\n Each successful match sends a request to the attacker\u2019s server. These requests are then processed using a reconstruction algorithm that assembles the original string from overlapping trigram sequences.<\/p>\n According to zhero_web_security<\/a>, the attack requires only a visit to a malicious site, automatically installing the mod, redirecting the browser, and immediately exfiltrating data.<\/p>\n In parallel, the researchers identified a denial-of-service condition in which triggering mod installation in private browsing mode could crash the browser and terminate sessions.<\/p>\n Opera patched the critical flaw in May 2026 after a coordinated disclosure through its bug bounty program,<\/a> promptly responding and awarding the maximum bounty to the researchers.<\/p>\n This vulnerability demonstrates how non-traditional attack surfaces, such as browser customization features, can introduce significant security risks.<\/p>\n It also reinforces the growing relevance of XS-Leak techniques, which exploit subtle browser behaviors rather than conventional script-based vulnerabilities.<\/p>\n The post Opera GX 0-Click Vulnerability Lets Attackers Exfiltrate User Data via Malicious Website<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"\"](\"https:\/\/i0.wp.com\/zhero-web-sec.github.io\/images\/opera-leaks-1.gif?ssl=1\")
<\/figure>\nOpera GX 0-Click Vulnerability<\/strong><\/h2>\n
![\"Attacker-controlled](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgQkjN1k7FFOvXFXCSk9rcxcILJ1XJvjckITvsQDcY4a5mOJzOS7Yq777VbxXoV__K9R9VDp7Klv3wdBrNyQqFj683qtHlj7i7gEf1lmiROb-TB1x_di5djinVig4_ZS-eBS_yVdK75zuml_uJ-ZuA5-qoVkTRKgTcTpOO3XARL67JbGMMMPoNQPITR2hw\/s1600\/Screenshot%25202026-07-06%2520141938%2520%25281%2529.webp?ssl=1\")
![\"\"](\"https:\/\/i0.wp.com\/zhero-web-sec.github.io\/images\/opera-leaks-8.gif?ssl=1\")
<\/figure>\n![\"Page](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiHBAlrz56bgSsdWnFi_8_E4Vv8-N10e-wuMuezBK5uMXda8zPzWQQpt0GVGDwSOWJRg8uXrY-uSnmcTMVgd5c8Qci7cyqgoM8EfmZC6Cm2VQ-6FZHghRMN9LnhaUEKsCj0GRv240hfDMZcpRLeZCalyYyA0HW-Rbkx6p21Y9LvsMTmJxl5o-doz32vatc\/s1600\/Screenshot%25202026-07-06%2520142126%2520%25281%2529.webp?ssl=1\")