Vulnerability Management, Application security

Private API compromise possible with now-patched Opera bug

Share
Computer repair concept. Hardware or software error.

Malicious actors could have compromised the Opera browser's private APIs through a malicious extension on the Chrome Web Store exploiting a recently addressed vulnerability as part of the CrossBarking attack, The Hacker News reports.

Included within the extension were content scripts that could be leveraged to compromise Opera's overly permissive domains, secure API access, capture open tab screenshots, obtain session cookies, and alter DNS-over-HTTPS settings, which could be followed by adversary-in-the-middle intrusions, according to a study from Guardio Labs. Such findings, which come months after the discovery of the Opera MyFlaw bug, indicate the need for more stringent measures to ensure the safety of browser extensions, said Guardio Labs Head Nati Tal. "The current review model falls short; we recommend bolstering it with additional manpower and continuous analysis methods that monitor an extension's activity even post-approval. Additionally, enforcing real identity verification for developer accounts is crucial, so simply using a free email and a prepaid credit card is insufficient for registration," said Tal.

An In-Depth Guide to Application Security

Get essential knowledge and practical strategies to fortify your applications.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.