Collected research

Local File Read via Stored XSS in The Opera Browser

Bug Bounty Guest Post: Local File Read via Stored XSS in The Opera Browser

Renwa · Opera Security · 8 September 2021

Opera Pinboards accepted a javascript URI as a saved pin, which then ran inside the privileged opera scheme when the link was middle-clicked. From there the researcher called native APIs to open a local file in a tab and capture its thumbnail, exfiltrating a screenshot of that file to a remote server.

Record

Document

Bug Bounty Guest Post: Local File Read via Stored XSS in The Opera Browser

Researcher

Renwa

Published by

Opera Security

Date

8 September 2021

Topic

XSS

In the archive

• Collected in the 2021 research round

Tags

• xss
• lfi
• privilege-escalation
• sop-bypass
• url-parsing
• filter-bypass
• bug-bounty
• case-study
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Renwa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.