Loading story…
Opera patched a critical vulnerability in Opera GX that allowed a malicious website to silently force-install a GX Mod and then abuse universal CSS injection to extract data from pages the victim later visited. Researchers zhero_ and inzo_ demonstrated that the attack could redirect a logged-in user to a Google account page and reconstruct the user’s full Gmail address, sending the data to an attacker-controlled server without requiring explicit approval from the victim.
The fix was released in Opera GX version 130.0.5847.89, which changed the mod installation pipeline so mods cannot be downloaded and enabled without clear user interaction and confirmation. Opera assigned the bug a top-severity P1 rating in its bounty program and said its review of systems and traffic found no evidence of exploitation in the wild; researchers also noted a separate issue where loading a .crx file in private mode could crash the browser and dump open tabs, affecting both Opera GX and the regular Opera browser.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that Opera awarded a $5,000 bug bounty for the Opera GX GX Mods vulnerability finding. This bounty was associated with the researchers' disclosure of the forced-install, data exfiltration, and DoS issues.
The researchers also found a denial-of-service issue in Opera GX where mod installation in private browsing mode could crash the browser and terminate sessions. This was described alongside the forced-install and data exfiltration vulnerability.
Researchers zhero_ and inzo_ found that a third-party website could force-install an Opera GX mod under specific conditions, then abuse CSS injection to read and exfiltrate certain page data. Their proof of concept redirected a logged-in user to a Google account page and extracted the user's Gmail address.
After investigating its systems and traffic, Opera said it is confident the vulnerability was not exploited in the wild. This statement accompanied the company's disclosure of the fix.
Opera fixed the vulnerability by changing the mod installation pipeline so mods cannot be downloaded and enabled without explicit user interaction and clear confirmation. The patch was included in Opera GX version 130.0.5847.89 and later.
The researchers said Opera patched the GX Mods vulnerability on 2026-05-08 after responsible disclosure through Opera's Bugcrowd program. According to the disclosure, Opera ultimately classified the issue as a P1 severity vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceblogs.opera.com
Open sourcezhero-web-sec.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google publicly released proof-of-concept exploit code for a long-unfixed Chromium vulnerability in the Browser Fetch API, exposing Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers to abuse by any malicious website a user visits. Researcher **Lyra Rebane** reported the flaw in late 2022, but it remained unresolved for years despite being internally classified as serious. The bug lets an attacker register a Service Worker and create a background fetch task that can persist as a covert communication channel, enabling browser monitoring, anonymous proxying, traffic redirection, and potential browser-based botnets; some implementations reportedly keep the connection alive even after the browser closes or the device reboots. At the same time, Google issued Chrome Stable Channel updates for versions before `148.0.7778.178/179`, and government and vulnerability trackers highlighted multiple newly disclosed flaws fixed in that release. Those included `CVE-2026-9120`, a high-severity WebRTC use-after-free that could allow remote code execution in the browser sandbox via a crafted HTML page; `CVE-2026-9126`, a DOM use-after-free with similar impact; and `CVE-2026-9121`, a GPU out-of-bounds read that could lead to heap corruption. The contrast between patched Chrome memory-corruption bugs and the still-unfixed Browser Fetch issue raised concern because the published exploit code lowers the barrier to abuse across millions of Chromium users, prompting recommendations to restrict Service Worker use, disable background fetch where possible, monitor outbound browser traffic, and consider browser isolation in enterprise environments.
Jun 29, 2026
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026
Google released emergency Chrome updates to fix two **high-severity zero-day vulnerabilities**, `CVE-2026-3909` and `CVE-2026-3910`, that are being **exploited in the wild**. Advisory reporting says the flaws can enable **data manipulation** and **security restriction bypass**, prompting a **high-risk** assessment. Google has not disclosed attack details, indicating access to technical information may remain restricted until more users have installed the fixes. Technical reporting identifies `CVE-2026-3909` as an **out-of-bounds write** in **Skia**, Chrome’s graphics library, and `CVE-2026-3910` as an **inappropriate implementation** issue in the **V8 JavaScript and WebAssembly engine**. Google said both were patched within days of being reported, with fixes rolling out to the Stable Desktop channel for **Windows `146.0.7680.75`**, **macOS `146.0.7680.76`**, and **Linux `146.0.7680.75`**. The company warned that full update deployment may take days or weeks, making prompt browser updates important while exploitation is ongoing.
Jun 29, 2026