Opera GX Zero-Click Vulnerability Exposed Users to Silent Data Theft A recently disclosed vulnerability in Opera GX allowed attackers to silently exfiltrate sensitive user data including Gmail addresses without any user interaction, simply by luring victims to a malicious website. The flaw, discovered by security researcher Rachid Allam, stemmed from the browser’s "GX Mods" feature, which enables customization via packaged `.crx` files. Unlike traditional browser extensions, GX Mods automatically install when downloaded, requiring no explicit user permission. Attackers exploited this behavior by embedding a malicious `.crx` file in a webpage, which installed in the background upon visitation. While GX Mods don’t execute JavaScript or request permissions, they can inject CSS across all visited sites, enabling a cross-site leak (XS-Leak) via universal CSS injection. The attack leveraged CSS-based data exfiltration, where carefully crafted selectors inferred sensitive information by triggering network requests to an attacker-controlled server. Researchers demonstrated this by reconstructing a victim’s Gmail address using trigrams three-character segments tested via thousands of CSS rules. Advanced techniques, including CSS variables and multi-layered background requests, allowed simultaneous data extraction without browser crashes. Once the victim visited a target page (e.g., a Google account page), the injected CSS probed for matching patterns, sending requests to the attacker’s server. A reconstruction algorithm then assembled the original data from overlapping trigrams. The attack required no user interaction beyond visiting a malicious site, with the mod installing automatically and initiating data theft. Additionally, researchers identified a denial-of-service (DoS) condition where triggering mod installation in private browsing mode could crash the browser. Opera patched the critical flaw in May 2026 following a coordinated disclosure through its bug bounty program, awarding the researchers the maximum bounty. The incident highlights the risks of non-traditional attack surfaces, such as browser customization features, and underscores the growing threat of XS-Leak techniques, which exploit subtle browser behaviors rather than conventional script-based vulnerabilities.