Critical Opera GX Vulnerability Lets Attackers Inject CSS Across Every Webpage

Gbhackers •Divya • July 6, 2026

A critical security vulnerability in Opera GX has been disclosed, revealing that attackers could exploit the browser’s GX Mods feature to inject malicious CSS across every webpage visited by a victim. This could enable cross-site data exfiltration and have a widespread impact on the browser. The research, published by zhero_web_security in 2026, demonstrates a zero-click […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Opera GX Vulnerability Enables CSS Injection and Data Theft A severe vulnerability in the Opera GX browser allows attackers to automatically install GX Mods without user consent, enabling cross-site data exfiltration. This flaw, discovered by researcher zhero_web_security, leverages the GX Mods feature to inject malicious CSS across all visited webpages. The attack can extract sensitive information, such as Gmail addresses, through crafted network requests triggered by the injected CSS. Additionally, this vulnerability poses a risk of denial-of-service (DoS) attacks, causing the browser to crash when a mod is installed in Incognito mode. The issue was reported in February 2026 and was initially rated as low priority but later reassessed as critical. Opera patched the vulnerability on May 8, 2026, and awarded a $5000 bounty to the researcher. The research was published on July 3, 2026, as a proof of concept. 3 sources 71

Extracted Entities

Critical Opera GX Vulnerability Lets Attackers Inject CSS Across Every Webpage

The full story

Extracted Entities

Attack Types (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)