# CrossBarking: Opera Browser 0-Day Private API Abuse via Cross-Browser Extension Store Attack

> Guardio Labs disclosed 'CrossBarking', a flaw in Opera that let a malicious extension (e.g. one distributed via the Chrome Web Store) inject content scripts into hardcoded privileged Opera domains and reach permissive Private APIs. This enabled screen capture, browser setting modification (PoC: DNS-over-HTTPS hijack) and account hijacking. Opera patched it on 2024-09-24; neither Opera nor Guardio reports in-the-wild exploitation.

- **Published:** 2026-10-16T23:30:41Z
- **Last reviewed:** 2026-10-16T23:30:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3787
- **ID:** TL-2026-3787
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrossBarking abuses the way Opera exposes browser 'Private APIs' to a set of hardcoded, privileged web origins that back first-party features such as Pinboard and Opera Wallet. Guardio Labs found that these origins included Opera-owned subdomains and test hosts (crypto-corner.op-test.net, op-test.net, pinboard.opera.com, gxc.gg, opera.atlassian.net) and third-party integration domains (vk, Instagram, Yandex). Opera did not block extension content scripts on them. An extension that declares a content script matching those domains (the PoC used <all_urls>) can inject script into the page's execution context and call Private APIs that ordinary web content and ordinary extensions cannot reach.

The delivery path is a cross-store attack. Opera's own add-ons store is manually reviewed, but Opera redirects users who look for some extensions to the Chrome Web Store. Guardio published a benign-looking 'puppy' extension there (justification: 'Add cute puppies to every page') as an unlisted item. It was approved within about 24 hours, because Chrome's policy checks look for Chrome-specific capabilities and an Opera-specific exploit triggers no alarms. The victim must install it in Opera and dismiss Opera's warning about third-party-store extensions.

Guardio's PoC built the payload as a base64-encoded JSON blob in a URL fragment on the privileged host (https://crypto-corner.op-test.net/#puppiesOn-<base64>). The script was injected dynamically through DOM manipulation, which sidesteps page CSP because extension-injected scripts are treated differently from inline scripts. The blob called chrome.settingsPrivate.setPref() to set dns_over_https.mode=secure and dns_over_https.templates to the PoC resolver https://bad.dnsserver.xyz, redirecting all browser DNS queries to an attacker-controlled DoH server for adversary-in-the-middle, phishing and surveillance. Guardio notes the exploit could run from the extension's onInstall event with no further user interaction.

Other exposed Private APIs per Guardio: pinboardPrivate (screen capture of tabs), chrome.cookies (session cookie theft and account hijacking) and management/addonsPrivate (disable or install extensions, including security tools). Fix, deployed 2024-09-24: content scripting was disabled on high-permission domains (similar to the Chrome Web Store domain protection) and third-party domain privileges (VK, Instagram, Yandex) were removed. Private APIs remain reachable in those contexts, so XSS on a privileged origin stays a valid vector, and Opera has started refactoring to remove the Private API architecture. No CVE or CVSS was assigned, affected Opera versions were not specified, and Opera and Guardio state there is no evidence of in-the-wild exploitation. The hostnames listed here are legitimate Opera infrastructure abused by design, so they are context for hunting extension behavior, not block-list candidates.

## MITRE ATT&CK

- T1176.001 Browser Extensions
- T1059.007 JavaScript
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1113 Screen Capture
- T1185 Browser Session Hijacking

## Sources

- [CrossBarking: Exploiting a 0-Day Opera Vulnerability with a Cross-Browser Extension Store Attack (Guardio Labs)](https://guard.io/labs/crossbarking-exploiting-a-0-day-opera-vulnerability-with-a-cross-browser-extension-store-attack)
- [Opera Security Blog: Vulnerability disclosure by Guardio](https://blogs.opera.com/security/2024/10/vulnerability-opera-guardio/)
- [The Hacker News: Opera Browser Fixes Big Security Hole That Could Have Exposed Your Information](https://thehackernews.com/2024/10/opera-browser-fixes-big-security-hole.html)
- [CyberInsider: Opera Browser Vulnerable to Cross-Browser Attacks via Malicious Extensions](https://cyberinsider.com/opera-browser-vulnerable-to-cross-browser-attacks-via-malicious-extensions/)
- [TechRadar: Opera browser had a major security flaw that could have exposed all your details](https://www.techradar.com/pro/security/opera-browser-had-a-major-security-flaw-that-could-have-exposed-all-your-details-so-patch-now)
- [Cyber Security News: Opera Browser 0-Day Flaw](https://cybersecuritynews.com/opera-browser-0-day-flaw/amp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3787