No Clicks, No Permissions: How a Critical Opera GX Flaw Worked
A serious security hole in Opera GX, the gaming-focused browser from Opera, allowed any website to silently install a customization mod — and then use that mod to siphon data from sites the victim had visited. The attack required zero user interaction. No clicking. No permission prompts. Just a hidden frame loading a file.
Discovered by an independent researcher known as zhero_web_security, the Opera GX flaw exploited the browser’s GX Mods system. Unlike standard browser extensions, GX Mods are supposed to be lightweight — they customize the browser’s look, sounds, and website styling, but carry no permissions and can’t execute JavaScript. That’s what made the discovery so unsettling: the mods weren’t supposed to be dangerous. Yet the researcher found a way to weaponize them.
Auto-Install: The Core of the Opera GX Vulnerability
Here’s the mechanical problem. When a user downloads a GX Mod file, it installs automatically. No dialogue box asks for approval. No permission request pops up. The researcher realized that an attacker could place a mod file inside a hidden HTML frame on a malicious website. As soon as the page loads, the mod lands in the browser — completely silent.
Once installed, the mod’s CSS (cascading style sheets) applies to every single tab and page the victim opens. Ordinary CSS injection is usually confined to one page. This was different. The Opera GX vulnerability gave the attacker a persistent foothold across the entire browser session.
Gmail Addresses and Browser Crashes: Proof of Concept
CSS cannot read a page’s content directly. But it can be cleverly crafted to trigger network requests based on what a page contains. That technique, known as an XS-Leak (cross-site leak), lets an attacker extract data bit by bit, character by character.
Using this method, the researcher built a zero-click exploit that recovered a victim’s full Gmail address. The attack silently redirected the browser to a Google account page, then used the injected CSS to leak the email address character by character. The researcher noted the method is not limited to Gmail — any data rendered on a page could theoretically be targeted.
The same auto-install behavior also enabled a denial-of-service (DoS) attack against both Opera and Opera GX. Chromium-based browsers block extensions in private or Incognito windows. Forcing a mod to install in Incognito mode caused the browser to crash — and wiped all open tabs in the process. Any file with a .crx extension triggered the crash, whether or not it was a legitimate mod.
From Low Priority to Critical: Opera’s Bug Bounty Response
The researcher reported the Opera GX flaw in February 2024 through Opera’s Bugcrowd bug bounty program. Initially, the team triaged it as low priority. That changed quickly. Opera’s security team reassessed the issue and reclassified it as critical.
A patch shipped on May 8, 2024, and the researcher received a $5,000 bounty payment. The full proof of concept was published on July 3, tested against Opera GX version 127.0.5778.41 — after the fix had already been distributed.
What This Means for Browser Security and Users
This isn’t the first time browser customization features have opened unexpected attack surfaces. But the Opera GX vulnerability is a sharp reminder that even permissionless systems can be dangerous. GX Mods were designed to be safe because they lack extension-level privileges. But CSS injection, combined with auto-installation, turned that safety assumption into a liability.
For users, the fix is straightforward: update Opera GX to the latest version. The browser should update automatically, but it’s worth checking. Anyone running a version prior to the May 8 patch is still exposed.
For the broader security community, the case raises questions about how browsers handle file-based installations and whether similar flaws exist in other Chromium-based browsers. The researcher’s work demonstrates that even a seemingly harmless mod can become a data theft tool — as long as it arrives without a click.
