Opera GX auto‑installs malicious mods, exposing Gmail addresses
A hidden iframe can force Opera GX to auto‑install a GX Mod that injects universal CSS. The CSS leaks a signed‑in user's full Gmail address via attribute‑selector tricks, proving a zero‑click data exfiltration. Opera patched the issue in version 130.0.5847.89; no CVE was assigned.