A zero-click cross-site leak (XS-Leak) vulnerability in the Opera GX browser allowed malicious websites to automatically install GX Mods, which could then inject CSS across all open tabs to exfiltrate user data, such as Gmail addresses, or cause a denial-of-service by crashing the browser in Incognito mode. The flaw was patched by Opera on May 8, 2026, with the researcher receiving a $5,000 bounty for the discovery.
Vulnerability Management Opera GX browser vulnerability could allow data theft and DoS attacks July 6, 2026 Share By SC Staff (Adobe Stock) Per Infosecurity Magazine, a vulnerability discovered in the Opera GX browser could allow malicious websites to automatically install customization mods and use them to steal data from other sites visited by a user, without requiring any interaction. The vulnerability, found by security researcher zhero_web_security, allows for a zero-click cross-site leak (XS-Leak) by exploiting the automatic installation of GX Mods. Unlike typical browser extensions, these mods do not require permission prompts and can be installed simply by downloading their file. This enables attackers to inject CSS across all open tabs and websites, bypassing the usual single-page limitations of CSS injection. The researcher demonstrated that this could be used to exfiltrate data piece by piece, successfully recovering a victim's Gmail address. Additionally, the auto-install behavior could be leveraged for a denial-of-service (DoS) attack. Forcing a mod installation in Incognito mode caused the browser to crash and close all open tabs. Opera patched the flaw on May 8, awarding a $5,000 bounty for the discovery. Source: Infosecurity Magazine SC Staff Related Vulnerability Management The context gap: Building trusted agents in the age of AI-accelerated exploitation Paul Wagenseil July 2, 2026 AI agents embedded in the SDLC need context, governance, and auditability to operate safely. Vulnerability Management CISA adds SharePoint flaw to known exploited vulnerabilities list Steve Zurier July 2, 2026 SharePoint offers bad actors a roadmap into how an organization operates. Vulnerability Management Apple releases early security updates, citing AI-driven exploit acceleration SC Staff July 1, 2026 The updates address critical flaws in WebKit, the rendering engine for Safari and other applications on Apple devices. Related Events Cybercast Why Mythos is the cybersecurity crisis we need Wed Jul 22 Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds