Improper Verification Vulnerability in Opera Neon by Opera Software
CVE-2026-123139

5.8MEDIUM

Key Information:

Vendor

Opera
Status
Neon
Vendor
CVE Published:
12 November 2026

What is CVE-2026-123139?

A vulnerability in Opera Neon on macOS and Windows allows malicious browser extensions to exploit improper verification of communication channel sources. By sending unauthorized commands via the MCP Hub to the built-in Browser Operator extension, an attacker can effectively gain control over the browser. The affected component is the MCP Hub extension version 0.0.1, which poses significant risks to user data and privacy.

Affected Version(s)

Neon Windows 1.0.0

References

https://security.opera.com/en/improper-verification-of-so...

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

maitai
.