CVE-2026-123139 · Other
NO FIX YET
Opera Neon on macOS and Windows does not verify the source of commands sent through its MCP Hub extension to the built-in Browser Operator extension. A malicious browser extension can use this to send commands and take control of the browser.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
People running Opera Neon on macOS or Windows with the MCP Hub extension at version 0.0.1 are affected, and a malicious browser extension installed on the same browser is the attack path. The sources do not say whether other MCP Hub versions or other browsers are affected.
Not affected if no-malicious-extension-installed
Who cares browser, macos, mcp, opera-neon, windows
Unknown from the sources.
No fix yet, per the sources.
Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.