'CrossBarking' Attack Targeted Secret APIs, Exposing Opera Browser Users

Guardio disclosed "CrossBarking," a proof-of-concept attack that leverages Opera's private browser APIs by abusing cross-site script injection or a malicious Chrome extension to execute code in the context of privileged domains. The researchers demonstrated the ability to alter settings (including DNS), hijack accounts, disable security extensions, and install malicious extensions; Opera responded by blocking extensions from running scripts on domains with private API access.