MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers via the Built-in 'Opera Touch Background' Extension (My Flow Feature)
MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers (TL-2026-0770), also tracked as MyFlaw, is a high-severity software vulnerability, first published 2026-06-10. It has no confirmed attribution, affects Opera Opera Browser, maps to 16 MITRE ATT&CK techniques (T1036, T1059, T1102), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0770
- Threat ID
- TL-2026-0770
- Also known as
- MyFlaw, My Flow RCE
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, consumer, general
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
Malware and tooling: urlscan.io
Guardio Labs (Oleg Zaytsev) disclosed 'MyFlaw', a cross-platform (Windows and macOS) remote code execution flaw in Opera and Opera GX. A malicious browser extension hijacks requests to a long-forgotten, CSP/SRI-less legacy My Flow asset on web.flow.opera.com, then drives the privileged 'Opera Touch Background' extension's message handlers to simulate a paired mobile device, drop an encrypted payload into ~/Downloads/MyFlow/, and execute it via opr.operaTouchPrivate.openFile with a single user click. Responsibly disclosed 2023-11-17 and fixed server-side by 2023-11-22; no evidence of in-the-wild exploitation.
How MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers works
MyFlaw is a design-and-asset-hygiene vulnerability in Opera's My Flow feature, which lets users sync notes and files between the Opera/Opera GX desktop browser and the Opera Touch mobile app. My Flow is mediated by a pre-installed, non-disableable, internal browser extension named 'Opera Touch Background', visible via opera://inspect. This built-in extension holds privileges unavailable to ordinary extensions: it can reach the private Opera API surface, including opr.operaTouchPrivate.openFile(String filename), which opens (executes) a file from local storage without the normal browser sandbox restrictions.
The extension's manifest declares an 'externally_connectable' boundary that permits inbound connections only from https://*.flow.opera.com/* and https://*.flow.op-test.net/*. Production My Flow pages enforce a strict CSP (meta script-src 'self' https://flow-dev.operacdn.com https://flow.operacdn.com) and Subresource Integrity (integrity="sha256-...") on their script tags. Guardio used urlscan.io historical scanning to locate an abandoned legacy My Flow landing page on web.flow.opera.com — more than two years old — that lacked both the CSP meta tag and any SRI attribute on a script tag that loaded /ext/v1/scripts.js. Because that page still resolved under the whitelisted *.flow.opera.com origin, it remained an authorized peer for the privileged extension.
The attack chain: an attacker publishes a seemingly benign browser extension (e.g. an ad-blocker-style tool) that requests the declarativeNetRequest permission. Once installed, the extension uses declarativeNetRequest rules to intercept and redirect the request for /ext/v1/scripts.js on the unprotected legacy page to attacker-controlled JavaScript. With CSP and SRI absent, the injected script runs in the page context that is externally_connectable to 'Opera Touch Background', giving it direct access to the extension's message port and its handlers: GET_PAIRING_TOKEN, GET_DEVICES, SEND_FILE, and OPEN_FILE. The injected code simulates a mobile device end-to-end — registering a fake device with encryption keys at flow.opera.com/v1/devices to obtain a DEVICE_ID and TOKEN, retrieving a pairing token via GET_PAIRING_TOKEN, and completing pairing at flow.opera.com/v1/connect-devices. Rather than transferring a file over the wire, it abuses SEND_FILE to write an encrypted malicious blob straight into the ~/Downloads/MyFlow/ folder, then calls OPEN_FILE -> opr.operaTouchPrivate.openFile to execute it, escaping the browser sandbox and the browser process entirely.
The only friction is that OPEN_FILE requires a user-gesture (click) context, downgrading the attack from zero-click to one-click. Guardio bridged this by injecting code into the 'Thank you for installing' page shown after the malicious extension is added, turning any click on that page into the execution trigger. The result is arbitrary native code execution on both Windows and macOS. Opera removed the underlying legacy assets server-side within five days and reported no evidence of exploitation; Guardio recommended deeper hardening, such as stripping third-party-extension reach from production My Flow domains, mirroring Chrome Web Store-style protections.
MITRE ATT&CK techniques used in TL-2026-0770
Defense Evasion
T1036 Masquerading; T1211 Exploitation for Stealth
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer
Persistence
Collection
T1185 Browser Session Hijacking
Initial Access
Discovery
Credential Access
T1528 Steal Application Access Token
Resource Development
T1587 Develop Capabilities; T1608 Stage Capabilities
defense-impairment
Affected products and versions in MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
- Opera — Opera Browser
Vulnerable versions: My Flow-enabled desktop builds prior to 2023-11-22 fix (Windows, macOS)
Fixed in: Builds incorporating the 2023-11-22 server-side legacy-asset removal - Opera — Opera GX
Vulnerable versions: My Flow-enabled desktop builds prior to 2023-11-22 fix (Windows, macOS)
Fixed in: Builds incorporating the 2023-11-22 server-side legacy-asset removal - Opera — Opera Touch (mobile companion to My Flow)
Vulnerable versions: My Flow pairing protocol abused via simulated device
Fixed in: N/A - desktop-side asset and origin hardening
Remediation for MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
Patches
- Opera server-side fix deployed 2023-11-22 removing the CSP/SRI-less legacy My Flow landing page on web.flow.opera.com
Immediate actions
- Ensure Opera and Opera GX are updated to the post-2023-11-22 release that incorporates Opera's server-side removal of the vulnerable legacy My Flow assets
- Audit installed Opera extensions and remove any untrusted extension requesting the declarativeNetRequest permission
- Restrict or disallow user installation of third-party Opera extensions in managed environments
Workarounds
- Disable or avoid relying on the My Flow feature until updated
- Block egress to legacy *.flow.opera.com hosts not required for current My Flow operation
Longer-term hardening
- Strip third-party-extension reach (externally_connectable) from production My Flow domains, mirroring Chrome Web Store-style protections recommended by Guardio
- Adopt continuous asset-inventory and legacy-endpoint decommissioning so orphaned pages cannot retain whitelisted origins
- Enforce mandatory CSP and SRI on every asset served under privileged externally_connectable origins
- Add runtime checks before privileged native API calls (opr.operaTouchPrivate.openFile) so sandbox-escaping execution requires more than a page message
Weaknesses (CWE) in MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
CWE-1188, CWE-829, CWE-693, CWE-94, CWE-358, CWE-668
Timeline of MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
- Opera launched the Opera Touch mobile browser, introducing the My Flow desktop-to-mobile messaging/file-sharing feature mediated on desktop by the built-in 'Opera Touch Background' extension (approximate month).
- Per Guardio, the abandoned CSP/SRI-less My Flow landing page on web.flow.opera.com that enables the attack dates from more than two years before disclosure (approximate date).
- Guardio Labs (Oleg Zaytsev) responsibly disclosed the MyFlaw RCE to Opera.
- Guardio Labs located the long-forgotten, code-injection-vulnerable legacy My Flow asset (retaining the whitelisted *.flow.opera.com origin and high-permission native browser API reach) via urlscan.io historical URL scanning.
- Opera deployed a server-side fix within five days, removing the vulnerable legacy My Flow assets; reported no evidence of in-the-wild exploitation.
- The Hacker News, SecurityWeek and others reported on MyFlaw, noting impact to Opera and Opera GX on Windows and macOS.
- Guardio Labs published the full MyFlaw technical write-up, demonstrating one-click cross-platform RCE on Opera and Opera GX (Windows and macOS).
- Opera reiterated that its extension store applies manual review of submitted extensions to help prevent distribution of malicious add-ons of the type required to weaponize MyFlaw.
- Opera published a blog response stating the flaw required installing a malicious extension, was never exploited in the wild, and had already been fixed server-side.
Sources cited for MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
- MyFlaw — Cross Platform 0-Day RCE Vulnerability Discovered in Opera's Browser
- MyFlaw: Cross-Platform 0-Day RCE Vulnerability Discovered in Opera's Browsers (Guardio Labs on guard.io)
- Opera MyFlaw Bug Could Let Hackers Run ANY File on Your Mac or Windows
- Remote Code Execution Vulnerability Found in Opera File Sharing Feature
- Opera's response to misleading headlines regarding the 'MyFlaw' security vulnerability
- Opera Browser Zero-Day RCE Vulnerability on Cross-Platforms
- Opera Browser MyFlaw Security Breach Warning
Threats related to MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers
- Google Chrome V8 Out-of-Bounds Read/Write Zero-Day CVE-2026-11645 Exploited in the Wild
- Google Chrome Stable 148.0.7778.178/179 — CVE-2026-9111 WebRTC Use-After-Free RCE & CVE-2026-9110 UI Inappropriate Implementation (16 CVEs Patched)
- Unpatched Chromium Background Fetch / Service Worker Persistence Flaw — Silent Post-Close JavaScript Execution (Details Accidentally Leaked by Google)
Detection coverage for TL-2026-0770
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0770 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.