Researchers have disclosed a critical security vulnerability in Opera GX that allows attackers to weaponize the browser’s GX Mods feature to inject malicious CSS across every webpage visited by a victim.
The 2026 research, published by zhero_web_security, details a zero-click attack chain that leverages automatic mod installation to perform a universal CSS injection, effectively converting a cosmetic customization system into a cross-origin side-channel capable of leaking sensitive data.
GX Mods are packaged assets (themes, sounds, CSS) that let Opera GX users personalize the browser. Unlike traditional extensions, these mods require no explicit permissions and do not run JavaScript.
Critical Opera GX Zero‑Click
The researchers discovered that Opera treats .crx-packaged mods as installable and will automatically install them when downloaded, even when the download is initiated silently inside an embedded iframe.
Visiting a specially crafted webpage becomes sufficient to trigger installation; the only user-visible sign is a notification bar that appears too late to prevent exploitation.
Once installed, the mod’s CSS is applied globally across all browser tabs, creating a universal injection vector that persists until the mod is removed.
Although CSS itself cannot read data directly, it can be used to conditionally trigger external network requests based on DOM state, a class of techniques known as XS-Leaks.
The disclosed attack exploits this by creating CSS selectors that match specific substrings of sensitive values (for example, parts of an email address) embedded in HTML attributes. When a selector matches, the rule triggers an external resource load (such as a background-image URL), leaking information to an attacker-controlled server.
To demonstrate practicality, the researchers targeted Gmail addresses present on a page. They generated roughly 151,000 CSS rules representing trigram (three-character) combinations of the target alphabet.
Each rule tests for the presence of a specific trigram at various positions; matches cause outbound requests encoding the discovered trigram.
To manage CSS specificity and prevent rules from clashing, the exploit uses CSS variables to store matches and layered background-image properties to produce simultaneous loads.
The approach produces overlapping substrings which the attacker’s reconstruction algorithm then assembles into the original string using an overlap-based search method similar to depth-first traversal.
Despite limitations like ambiguous repeated substrings, the trigram reconstruction reliably recovers sensitive values from a single page load.
The attack chain is fully automated and requires no user interaction beyond visiting the malicious page. After the mod installs silently, the victim is redirected to a target site (such as a Google account endpoint) where the sought-after value is present in page attributes; the injected CSS runs immediately and begins exfiltration before any user can respond, a true zero-click data leak.
Beyond data exfiltration, zhero_web_security also found a denial-of-service condition affecting both Opera GX and standard Opera.
Triggering a .crx download while in Incognito mode causes the browser to crash and restart, wiping private sessions. This stems from flawed handling of the extension installation pipeline under private browsing.
Following responsible disclosure via Opera’s bug bounty program, Opera has shipped fixes addressing the reported issues.
The research underscores the security risk of non-traditional extension mechanisms that bypass permission models and demonstrates how global styling features can be repurposed into potent cross-origin side channels.
For network security teams and browser vendors, the findings reinforce the need for stricter controls: block silent or automatic installations from untrusted origins, apply tighter sandboxing to cosmetic assets, and limit the global application of untrusted CSS.
Deploying data loss prevention and network monitoring to detect suspicious outbound resource requests can also help mitigate similar attacks in the wild.
No Comment! Be the first one.