A critical security vulnerability in Opera GX has been disclosed, revealing that attackers could exploit the browser’s GX Mods feature to inject malicious CSS across every webpage visited by a victim.
This could enable cross-site data exfiltration and have a widespread impact on the browser. The research, published by zhero_web_security in 2026, demonstrates a zero-click attack chain that exploits automatic mod installation to execute a universal CSS injection. This effectively transforms a cosmetic customization feature into a powerful cross-origin side-channel attack vector.
Critical Opera GX Vulnerability
GX Mods in Opera GX allow users to customize the browser’s appearance using packaged assets, such as themes, sounds, and CSS files. Unlike traditional browser extensions, these mods do not require explicit permissions or JavaScript execution.
However, researchers discovered that GX Mods packaged as .crx files are automatically installed when downloaded, even when the installation occurs silently via an embedded iframe.
This behavior enables attackers to deliver malicious mods simply by luring victims to a specially crafted webpage, requiring no user interaction beyond visiting the site. The only visible indicator is a notification bar that appears too late to prevent exploitation.
Once installed, the malicious mod’s CSS is globally applied across all browser tabs, creating a universal injection vector. This allows attackers to exploit CSS-based data-exfiltration techniques, commonly known as XS-Leaks.
Although CSS cannot directly read sensitive data, it can conditionally trigger external resource requests based on DOM attributes. By crafting selectors that match specific values, such as parts of an email address, attackers can infer sensitive information through outbound network requests.
The researchers demonstrated a practical exploitation scenario targeting Gmail addresses. By generating thousands of CSS rules based on trigram combinations (three-character sequences), the attack identifies substrings within a victim’s email address embedded in HTML attributes.
These matches trigger requests to attacker-controlled servers, effectively leaking fragments of the data. To overcome CSS cascade limitations and prevent rule collisions, the attack uses CSS variables to store multiple matches and load them simultaneously via layered background-image properties.
A key innovation in the attack is the use of trigram-based reconstruction. With approximately 151,000 CSS rules, the attack extracts overlapping substrings of the target value.
These fragments are then processed using a reconstruction algorithm that reassembles the original string using an overlap-based approach similar to depth-first search. Despite constraints such as limited visibility into repeated substrings, the method reliably reconstructs sensitive data from a single page load.
The attack chain is fully automated. After installing the malicious mod, the victim is redirected to a target page, such as a Google account endpoint, where the email address appears in multiple attributes. The injected CSS executes immediately, exfiltrating data before the user can react, creating a true zero-click data leak scenario.
In addition to data exfiltration, the researchers identified a denial-of-service (DoS) condition affecting both Opera GX and standard Opera browsers.
Triggering a .crx download in Incognito mode causes the browser to crash and restart, resulting in complete session loss. This issue arises from how the browser handles extension installation pipelines under private browsing conditions.
Following responsible disclosure through its bug bounty program, Opera has addressed the reported vulnerabilities. The findings highlight the security risks associated with non-traditional extension mechanisms and reinforce the need for stricter controls surrounding automatic installations and global styling capabilities.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
