Opera Browser fixes flaw dubbed "Cross Barking" allowing malicious extensions to access private APIs
Take action: This is a scary variation on a common risk theme - browser plugins and malicious actions. This one is specific to Opera and Chrome extensions which are compatible with Opera but not thoroughly checked by Google. Update your Opera browse and practice installing extensions from Opera's vetted Add-ons Store, avoid third-party extensions where possible.
Learn More
Opera reports they have resolved a security vulnerability in its web browser, known as “CrossBarking,” which allowed malicious extensions to gain unauthorized access to private APIs.
The vulnerability, identified by cybersecurity researchers at Guardio Labs, was patched on September 24, 2024. It potentially enables attackers to perform actions such as account hijacking, session cookie theft, and DNS manipulation.
Ther flaw doesn'h have a CVE identifier. It exploits Opera’s architecture, where specific web apps on privileged domains were granted access to private APIs. These APIs support core Opera features like Opera Flow, Opera Wallet, and Pinboard.
Guardio demonstrated that malicious extensions, if installed from third-party stores like the Chrome Web Store, could inject code into these privileged domains. Once installed, the extension could bypass Opera’s security controls and perform actions such as capturing screenshots, extracting session cookies, and altering DNS-over-HTTPS settings—enabling potential man-in-the-middle attacks.
Guardio created a proof-of-concept for this attack using a seemingly harmless puppy-themed extension. The extension could be installed by Opera users directly from the Chrome Web Store, circumventing Opera’s own Add-ons Store, which performs manual reviews of extensions. Users who ignored Opera’s warning about third-party extensions were at risk of unknowingly installing malicious software.
Opera worked with Guardio to address the vulnerability promptly and remove affected third-party domain privileges. They are also reviewing the architecture of web app features to prevent similar security risks in the future.
Users are advised to:
- Update Browser: Ensure Opera is up-to-date to benefit from the latest security patches.
- Use Opera’s Add-ons Store: Opera advises users to install extensions exclusively from its manually reviewed Add-ons Store.
- Caution with Third-Party Extensions: Users should avoid downloading extensions from external sources like the Chrome Web Store, as these lack Opera’s review safeguards.
Opera continues to encourage responsible vulnerability disclosures from security researchers and offers a bug bounty program to enhance browser security.
