Opera Blog

And? Google uses Chrome to retrieve data about the user.

Every Chromium-based browser has 'hidden' APIs only accessible on certain domains. That's how the custom (read: closed source) extensions work. "Component extensions" are used to interact with them normally: https://chromium.googlesource.com/chromium/src/+/main/extensions/docs/component_extensions.md

See https://blogs.opera.com/security/2021/09/8000-bug-bounty-highlight-xss-to-rce-in-the-opera-browser/ and https://blogs.opera.com/security/2021/09/bug-bounty-guest-post-local-file-read-via-stored-xss-in-the-opera-browser/ for examples of when there are vulnerabilities in those extensions, and how they can be abused for remote code execution.

Any whitelisted domains for these APIs cannot be written to using user-installed extensions, in order for a malicious extension to not be able to inject a script and execute the special API.

At Opera, we previously tried attacking the underlying implementation about how these 'hidden' APIs are accessible. Although we found a lot of Opera-specific issues, the Chromium logic seems sound and a "bypass" for other websites accessing the API is unlikely. It also seems that the developer here was just a bit overzealous in allowing this API to be accessed from all google.com subdomains.

Have you tried watching Amazon Prime on Opera browser? Most premium content will not play on any browser other than Chrome, Edge and Firefox. If they play, it will be only SD version. This is not because Opera has not implemented some web standards. It is because the major three browsers have all implemented a proprietary system of content protection.

There is another side of this story. Let's say you have to publish content on your website. You do not have any way to publish it as securely as "Amazon Prime" without signing an agreement with Google and Microsoft.

Thirdly, there comes DRM protection rules thanks to team MPAA. In most countries, you can not try to reverse-engineer the proprietary decryption module that comes with browsers without breaking laws.

Because of the above restriction, security professionals cannot break into the proprietary module to detect security vulnerabilities.

Edit: I was wrong about Opera. Opera is in on the DRM bandwagaon for a long time. https://blogs.opera.com/desktop/2015/07/opera-developer-32-0-1910-0-netflix-edition/

In Opera, with their "VPN" it only affects traffic within the browser and it sounds like that's the same thing Firefox will offer.

A proxy isn't as secure as a full VPN. I had previously read a really good article on it but I hunted and hunted but couldn't find it.

This explains it well enough though:

https://www.quora.com/Is-Opera-browser-with-built-in-VPN-a-genuine-VPN

However, reading the write up from Opera it's actually pretty decent tech that they've had audited by a third party and the whole nine:

Why browsing with Opera’s VPN is safer
https://blogs.opera.com/security/2025/07/opera-vpn-is-safe/

Hopefully no one will start with the whole "they're Chinese owned" argument. If anybody is still on that whole trip, see this (and go watch SomeOrdinaryGamer's video on the subject) but in short it's really nothing to worry about.

Debunking misinformation about Opera’s browsers
https://blogs.opera.com/security/2023/07/debunking-spyware-misinformation/

Nope, actually "both Brave and Opera still support manifest v2" is objectively wrong.

Brave does NOT support manifest v2. They have instead hand picked exactly 4 manifest v2 extensions (AdGuard, NoScript, uBlock Origin, and uMatrix) and have hard-coded special support for them. They quite literally say in https://brave.com/blog/brave-shields-manifest-v3/ that all other v2 extensions will go away from Brave once Google fully removes support for them (which may have happened already, since it was posted a while ago).

As for Opera (https://blogs.opera.com/news/2025/09/mv2-extensions-opera/):

> MV3 extensions are the new standard and will offer a more stable and secure experience. Opera itself will shift to an MV3-only extension store.

You have your timeline backwards. Opera was the first browser to implement a built-in native adblocker in 2016. Here is the blog announcement:
https://blogs.opera.com/desktop/2016/03/opera-built-ad-blocking-now-beta/

Opera was and actually continues to be a pioneering browser with many "firsts" over the years. I was an avid user of it for a decade but I am saddened that it has become surrounded in controversy with a shady Chinese owner and predatory loans and stopped using it two years ago.

https://www.engadget.com/2020/01/19/opera-accused-of-predatory-loan-apps/

> However, Opera's development for the past few years has mostly been chasing trends and splitting resources across multiple web browsers. The first experiment after the company's purchase was Opera Neon, which was introduced in 2017 as a concept for new browser design. It was seemingly updated for a few months and then quietly dropped.

Speak of the devil, they just re-announced Opera Neon yesterday but now it's an "agenic AI browser". They're not beating the trend-chaser allegations.

https://blogs.opera.com/news/2025/05/opera-neon-first-ai-agentic-browser/