threat-intel
Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages
High
Summary
A vulnerability in Opera GX allowed malicious websites to silently install browser add-ons that could steal data from visited pages. Researchers demonstrated how a malicious iframe could install a mod, which then injected CSS to extract specific data, such as email addresses, from every page the browser visited. The attack, dubbed an ‘XS-Leak’, required no user interaction beyond visiting a compromised site. While Opera patched the data-theft fix, the underlying auto-install mechanism remained, and the vulnerability was initially misclassified due to its complexity.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data