Opera GX Auto-Install Pipeline Enabled Universal CSS XS-Leak Stealing Gmail Addresses via 150k Attribute Selectors

The attack chain began with a hidden iframe loading a crafted .crx that Opera GX auto-enabled without prompt. The mod's CSS used overlapping three-character attribute selectors targeting hidden email fields, triggering outbound requests only on matching prefixes. Researchers reconstructed full addresses in seconds after redirecting the victim to the Google account page while the mod remained active. A secondary path crashed the browser in Incognito mode by triggering the same extension pipeline on any .crx. Evidence shows Opera patched only the 2023 Renwa address-bar spoof escalation but retained the underlying auto-install behavior documented in procurement-style mod delivery logs and release notes. This mirrors patterns in other Chromium forks where cosmetic extension channels bypass permission gates, creating persistent cross-site data channels that standard CSP cannot block. The P1 bounty and $5,000 payout confirm internal recognition of the severity, yet the absence of a CVE and lack of public crash advisory indicate incomplete disclosure. Other browsers retain similar mod pipelines, exposing users to identical universal injection risks until install flows are gated. Next steps include auditing all Chromium forks for auto-download endpoints and monitoring extension store telemetry for anomalous .crx loads.