# MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers via the Built-in 'Opera Touch Background' Extension (My Flow Feature)

> Guardio Labs (Oleg Zaytsev) disclosed 'MyFlaw', a cross-platform (Windows and macOS) remote code execution flaw in Opera and Opera GX. A malicious browser extension hijacks requests to a long-forgotten, CSP/SRI-less legacy My Flow asset on web.flow.opera.com, then drives the privileged 'Opera Touch Background' extension's message handlers to simulate a paired mobile device, drop an encrypted payload into ~/Downloads/MyFlow/, and execute it via opr.operaTouchPrivate.openFile with a single user click. Responsibly disclosed 2023-11-17 and fixed server-side by 2023-11-22; no evidence of in-the-wild exploitation.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-10-17T00:29:12.339Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0770
- **ID:** TL-2026-0770
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MyFlaw is a design-and-asset-hygiene vulnerability in Opera's My Flow feature, which lets users sync notes and files between the Opera/Opera GX desktop browser and the Opera Touch mobile app. My Flow is mediated by a pre-installed, non-disableable, internal browser extension named 'Opera Touch Background', visible via opera://inspect. This built-in extension holds privileges unavailable to ordinary extensions: it can reach the private Opera API surface, including opr.operaTouchPrivate.openFile(String filename), which opens (executes) a file from local storage without the normal browser sandbox restrictions.

The extension's manifest declares an 'externally_connectable' boundary that permits inbound connections only from https://*.flow.opera.com/* and https://*.flow.op-test.net/*. Production My Flow pages enforce a strict CSP (meta script-src 'self' https://flow-dev.operacdn.com https://flow.operacdn.com) and Subresource Integrity (integrity="sha256-...") on their script tags. Guardio used urlscan.io historical scanning to locate an abandoned legacy My Flow landing page on web.flow.opera.com — more than two years old — that lacked both the CSP meta tag and any SRI attribute on a script tag that loaded /ext/v1/scripts.js. Because that page still resolved under the whitelisted *.flow.opera.com origin, it remained an authorized peer for the privileged extension.

The attack chain: an attacker publishes a seemingly benign browser extension (e.g. an ad-blocker-style tool) that requests the declarativeNetRequest permission. Once installed, the extension uses declarativeNetRequest rules to intercept and redirect the request for /ext/v1/scripts.js on the unprotected legacy page to attacker-controlled JavaScript. With CSP and SRI absent, the injected script runs in the page context that is externally_connectable to 'Opera Touch Background', giving it direct access to the extension's message port and its handlers: GET_PAIRING_TOKEN, GET_DEVICES, SEND_FILE, and OPEN_FILE. The injected code simulates a mobile device end-to-end — registering a fake device with encryption keys at flow.opera.com/v1/devices to obtain a DEVICE_ID and TOKEN, retrieving a pairing token via GET_PAIRING_TOKEN, and completing pairing at flow.opera.com/v1/connect-devices. Rather than transferring a file over the wire, it abuses SEND_FILE to write an encrypted malicious blob straight into the ~/Downloads/MyFlow/ folder, then calls OPEN_FILE -> opr.operaTouchPrivate.openFile to execute it, escaping the browser sandbox and the browser process entirely.

The only friction is that OPEN_FILE requires a user-gesture (click) context, downgrading the attack from zero-click to one-click. Guardio bridged this by injecting code into the 'Thank you for installing' page shown after the malicious extension is added, turning any click on that page into the execution trigger. The result is arbitrary native code execution on both Windows and macOS. Opera removed the underlying legacy assets server-side within five days and reported no evidence of exploitation; Guardio recommended deeper hardening, such as stripping third-party-extension reach from production My Flow domains, mirroring Chrome Web Store-style protections.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1176 Software Extensions
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1528 Steal Application Access Token
- T1518 Software Discovery
- T1185 Browser Session Hijacking
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1176.001 Software Extensions
- T1204.002 User Execution

## Sources

- [MyFlaw — Cross Platform 0-Day RCE Vulnerability Discovered in Opera's Browser](https://labs.guard.io/myflaw-cross-platform-0-day-rce-vulnerability-discovered-in-operas-browsers-099361a808ab)
- [MyFlaw: Cross-Platform 0-Day RCE Vulnerability Discovered in Opera's Browsers (Guardio Labs on guard.io)](https://guard.io/labs/myflaw-cross-platform-0-day-rce-vulnerability-discovered-in-operas-browsers)
- [Opera MyFlaw Bug Could Let Hackers Run ANY File on Your Mac or Windows](https://thehackernews.com/2024/01/opera-myflaw-bug-could-let-hackers-run.html)
- [Remote Code Execution Vulnerability Found in Opera File Sharing Feature](https://www.securityweek.com/remote-code-execution-vulnerability-found-in-opera-file-sharing-feature/)
- [Opera's response to misleading headlines regarding the 'MyFlaw' security vulnerability](https://blogs.opera.com/security/2024/01/opera-misleading-headlines-myflaw-vulnerability/)
- [Opera Browser Zero-Day RCE Vulnerability on Cross-Platforms](https://www.darkrelay.com/post/opera-zero-day-rce-vulnerability)
- [Opera Browser MyFlaw Security Breach Warning](https://cybermaterial.com/opera-browser-myflaw-security-breach-warning/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0770