Things I broke
MyFlaw
A web page that could run any file on your computer. A sandbox escape and remote code execution in Opera, on Windows and macOS.
- 300M+
- Opera users exposed
- 5 days
- from report to patch
- Windows + macOS
- one exploit, both platforms
Opera’s “My Flow” lets you share files between your phone and your desktop browser. Under the hood it was a privileged channel between web content and the operating system — and a web page could reach it.
MyFlaw chained that into a full sandbox escape: a malicious page could drop and execute files on the user’s machine, cross-platform. Opera shipped a fix within five days of disclosure.
In the press
Read the research
PhishForce