Threat reportVulnerabilityTL-2026-3787
CrossBarking: Opera Browser 0-Day Private API Abuse via Cross-Browser Extension Store Attack
CrossBarking (TL-2026-3787), also tracked as CrossBarking, is a high-severity software vulnerability, first published 2026-10-16. It has no confirmed attribution, affects Opera Software Opera browser, maps to 8 MITRE ATT&CK techniques (T1036, T1059.007, T1113), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-3787
- Threat ID
- TL-2026-3787
- Also known as
- CrossBarking
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, consumer, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in CrossBarking
Malware and tooling: Guardio 'puppy' PoC extension
How CrossBarking works
Guardio Labs disclosed 'CrossBarking', a flaw in Opera that let a malicious extension (e.g. one distributed via the Chrome Web Store) inject content scripts into hardcoded privileged Opera domains and reach permissive Private APIs. This enabled screen capture, browser setting modification (PoC: DNS-over-HTTPS hijack) and account hijacking. Opera patched it on 2024-09-24; neither Opera nor Guardio reports in-the-wild exploitation.
CrossBarking abuses the way Opera exposes browser 'Private APIs' to a set of hardcoded, privileged web origins that back first-party features such as Pinboard and Opera Wallet. Guardio Labs found that these origins included Opera-owned subdomains and test hosts (crypto-corner.op-test.net, op-test.net, pinboard.opera.com, gxc.gg, opera.atlassian.net) and third-party integration domains (vk, Instagram, Yandex). Opera did not block extension content scripts on them. An extension that declares a content script matching those domains (the PoC used <all_urls>) can inject script into the page's execution context and call Private APIs that ordinary web content and ordinary extensions cannot reach.
The delivery path is a cross-store attack. Opera's own add-ons store is manually reviewed, but Opera redirects users who look for some extensions to the Chrome Web Store. Guardio published a benign-looking 'puppy' extension there (justification: 'Add cute puppies to every page') as an unlisted item. It was approved within about 24 hours, because Chrome's policy checks look for Chrome-specific capabilities and an Opera-specific exploit triggers no alarms. The victim must install it in Opera and dismiss Opera's warning about third-party-store extensions.
Guardio's PoC built the payload as a base64-encoded JSON blob in a URL fragment on the privileged host (https://crypto-corner.op-test.net/#puppiesOn-<base64>). The script was injected dynamically through DOM manipulation, which sidesteps page CSP because extension-injected scripts are treated differently from inline scripts. The blob called chrome.settingsPrivate.setPref() to set dns_over_https.mode=secure and dns_over_https.templates to the PoC resolver https://bad.dnsserver.xyz, redirecting all browser DNS queries to an attacker-controlled DoH server for adversary-in-the-middle, phishing and surveillance. Guardio notes the exploit could run from the extension's onInstall event with no further user interaction.
Other exposed Private APIs per Guardio: pinboardPrivate (screen capture of tabs), chrome.cookies (session cookie theft and account hijacking) and management/addonsPrivate (disable or install extensions, including security tools). Fix, deployed 2024-09-24: content scripting was disabled on high-permission domains (similar to the Chrome Web Store domain protection) and third-party domain privileges (VK, Instagram, Yandex) were removed. Private APIs remain reachable in those contexts, so XSS on a privileged origin stays a valid vector, and Opera has started refactoring to remove the Private API architecture. No CVE or CVSS was assigned, affected Opera versions were not specified, and Opera and Guardio state there is no evidence of in-the-wild exploitation. The hostnames listed here are legitimate Opera infrastructure abused by design, so they are context for hunting extension behavior, not block-list candidates.
MITRE ATT&CK techniques used in TL-2026-3787
Defense Evasion
Execution
Collection
T1113 Screen Capture; T1185 Browser Session Hijacking
Persistence
Credential Access
T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
defense-impairment
Affected products and versions in CrossBarking
- Opera Software — Opera browser
Vulnerable versions: Versions not specified in sources (pre-2024-09-24 builds)
Fixed in: Fix deployed 2024-09-24
Remediation for CrossBarking
Patches
- Opera server/browser-side fix of 2024-09-24: content scripting disabled on high-permission domains; third-party domain privileges (VK, Instagram, Yandex) removed
Immediate actions
- Update Opera to the current release (fix deployed 2024-09-24)
- Audit extensions installed in Opera that came from the Chrome Web Store and remove any not required
- Review Opera DNS-over-HTTPS settings (dns_over_https.mode / dns_over_https.templates) for unexpected resolvers
Workarounds
- Do not dismiss Opera's third-party-store extension warning
- Block or alert on extensions requesting <all_urls> content scripts from unknown publishers
Longer-term hardening
- Restrict extension installation in managed browsers to an allow-list
- Monitor endpoint and DNS telemetry for browsers using unapproved DoH resolvers
- Prefer Opera's manually reviewed add-ons store over third-party stores
Weaknesses (CWE) in CrossBarking
Timeline of CrossBarking
- Opera deploys the fix: content scripting disabled on high-permission domains and third-party domain privileges (VK, Instagram, Yandex) removed.
- As of publication Opera has started refactoring to eliminate the vulnerable Private API architecture; XSS on privileged origins remains a theoretical vector.
- The Hacker News reports the fix and lists privileged domains with Private API access (crypto-corner.op-test.net, op-test.net, gxc.gg, opera.atlassian.net, pinboard.opera.com, instagram.com, yandex.com).
- Opera and Guardio state there is no evidence of in-the-wild exploitation of this scenario.
- Opera publishes its security blog post crediting Guardio and stating no Opera user was affected before the patch.
- Guardio Labs publishes 'CrossBarking' research describing the cross-browser extension store attack and PoC (DoH hijack via settingsPrivate.setPref).
- CyberInsider publishes coverage of the cross-browser attack; press reports confirm the PoC extension was published on the Chrome Web Store and that no exploitation was known before the patch.
Sources cited for CrossBarking
- CrossBarking: Exploiting a 0-Day Opera Vulnerability with a Cross-Browser Extension Store Attack (Guardio Labs)
- Opera Security Blog: Vulnerability disclosure by Guardio
- The Hacker News: Opera Browser Fixes Big Security Hole That Could Have Exposed Your Information
- CyberInsider: Opera Browser Vulnerable to Cross-Browser Attacks via Malicious Extensions
- TechRadar: Opera browser had a major security flaw that could have exposed all your details
- Cyber Security News: Opera Browser 0-Day Flaw
Detection coverage for TL-2026-3787
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3787 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.