Skip to content
OpenAdvisories
Medium · 5.8 CVE-2026-123139 EUVD-2026-124370GHSA-2f45-6797-cj93

Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser …

Published Nov 12, 2026 · Assigned by Opera

Description

Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.

Affected products

VendorProductAffectedFixed
Opera Neon 1.0.0 —

References