Opera GX's Mod Auto-Installer Let Attackers Silently Steal Your Gmail Address With Pure CSS

Opera GX, the browser that slaps gaming aesthetics on top of Opera's Chromium fork, just got patched for a genuinely clever attack that combined a lazy auto-install feature with CSS trickery to silently reconstruct a victim's Gmail address. No clicks required.

The fix landed in Opera GX 130.0.5847.89. If you're on a current build, you're covered. Check opera://about if you want to be sure. There's no CVE assigned.

The root of the problem is how GX Mods work. These are cosmetic packages, essentially .crx files that bundle custom themes, sounds, wallpapers, and CSS to restyle sites. Unlike full browser extensions, they can't run JavaScript and carry no permissions. Sounds harmless enough.

Except Opera installs them automatically. No approval prompt, no confirmation dialog. A malicious page can trigger this by loading a hidden iframe pointing at a .crx file, and the mod installs silently in seconds. The only sign anything happened is a small notification bar under the address bar with a Remove button. A bar most users will never even see before the attack completes.

This auto-install behaviour is not a new discovery. Researcher Renwa flagged it in 2023 and used it to spoof the address bar by escalating an installed mod into a full extension. Opera patched that specific escalation path in March 2023 but left the auto-install mechanism itself completely intact. Predictably, that's where this new research picks up.

The interesting part is what researchers did with a mod that's supposedly just styling. A GX Mod's CSS doesn't stay on one page. It applies universally, following the browser across every site it opens. That's a very different threat surface from ordinary CSS injection, which is sandboxed to the page it lands on.

CSS can't read a page's content and phone home on its own, but it can be weaponised to leak data character by character using attribute selectors. The technique works by writing CSS rules that test whether a particular HTML attribute begins with a given character sequence, and fetching a background image from an attacker-controlled server only when the condition matches. Run enough of these queries and you reconstruct the full value, bit by bit. Researchers call this an XS-Leak, cross-site leak.

For their proof of concept, researchers targeted Google's account page at myaccount.google.com/contactemail, which happens to embed the signed-in user's email address across three HTML attributes. They packed a mod with around 150,000 CSS rules, enough to cover every possible three-letter chunk of an email address. A reconstruction script on the attacker's server stitches the matching fragments back together.

They first tried four-letter chunks, which required 5.6 million rules and nearly 900 MB of CSS. The browser gave up. Three-letter overlapping chunks worked fine.

The full attack chain is depressingly tidy. Victim lands on malicious page. Mod installs within seconds. A few lines of JavaScript redirect the browser to the Google account page. The mod's CSS is already active, so it starts firing requests as the page loads. The Gmail address leaks before the victim has had any realistic chance to notice the notification bar, let alone click Remove.

The proof of concept extracted a Gmail address, but the same approach works on anything a page exposes in its markup, usernames, identifiers, whatever the attacker aims the CSS rules at.

Researchers also documented a second, blunter issue on the same code path. Loading a .crx file while in private mode crashes the browser and dumps every open tab. This one affects regular Opera too, not just GX, since any .crx file triggers the extension-install pipeline. Opera's advisory covers the data-theft fix but doesn't mention the crash.

The report nearly got buried. Opera runs its bounty programme through Bugcrowd, and initial triage analysts misread the severity, rating it a middling P3. The researchers made their case in about the most direct way possible: while an analyst was reproducing the attack, they caught the analyst's own CSS trigram requests, reconstructed the analyst's Gmail address, and pasted it into the bug report. Opera's team promptly upgraded it to P1, the highest severity tier, and paid the $5,000 maximum bounty.

Opera's own advisory is more diplomatic. The company says it is 'quite confident' the flaw was never exploited in the wild and describes the attack as requiring several things to go right simultaneously: the victim lands on a malicious site, receives a mod, and ignores the removal notice long enough for the redirect to fire.

That framing is technically accurate and practically misleading. The redirect runs in the seconds between mod installation and a user noticing anything at all. The removal notice is there. It just isn't there for long enough to matter.

This isn't Opera's first time having a convenience feature weaponised against its users. The 2024 MyFlaw bug turned Opera's My Flow file-sharing feature into a remote code execution vector. And the auto-install behaviour at the centre of this attack had been flagged as a risk since 2023.

The lesson isn't that cosmetic browser features are inherently dangerous. It's that 'this has no permissions' and 'this can't run JavaScript' are not the same as 'this is safe.' CSS that follows you across every site you visit is CSS with a lot of reach. Turns out reach is enough.