{"id":"CVE-2026-123139","kind":"vulnerability","aliases":["CVE-2026-123139"],"related":[],"title":"Opera Neon: malicious browser extension can take control via MCP Hub","description":"Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.","summary":"Opera Neon on macOS and Windows does not verify the source of commands sent through its MCP Hub extension to the built-in Browser Operator extension. A malicious browser extension can use this to send commands and take control of the browser.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","macos","mcp","opera-neon","other","windows"],"not_affected_if":["no-malicious-extension-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T13:17:11+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:54+00:00","updated_at":"2026-11-12T13:38:54+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T13:38:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Opera Neon: malicious browser extension can take control via MCP Hub","impact":"high","summary":"Opera Neon on macOS and Windows does not verify the source of commands sent through its MCP Hub extension to the built-in Browser Operator extension. A malicious browser extension can use this to send commands and take control of the browser.","audience":"everyone","category":"other","nicknames":[],"who_cares":["opera-neon","browser","mcp","macos","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes control of the browser via a malicious extension","analyst_note":"Find the vendor advisory or fixed MCP Hub version and confirm whether the Browser Operator flaw is patched; check the NVD page for the exact user-interaction requirement.","how_to_check":"- unknown","plain_action":"unknown","product_name":"","needs_analyst":true,"not_affected_if":["no-malicious-extension-installed"],"who_is_affected":"People running Opera Neon on macOS or Windows with the MCP Hub extension at version 0.0.1 are affected, and a malicious browser extension installed on the same browser is the attack path. The sources do not say whether other MCP Hub versions or other browsers are affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4555,"output_tokens":483,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123139':14A,17A '-2026':13A,16A '0.0.1':119C 'affect':113C 'allow':86C 'browser':4A,18B,50B,55B,68B,89C,96C,108C 'built':48B,106C 'built-in':47B,105C 'channel':77C 'command':38B,62B,99C 'communic':76C 'control':8A,65B,93C 'cve':12A,15A 'extens':5A,44B,52B,56B,90C,110C,118C 'hub':11A,43B,102C,117C 'improp':69C 'issu':112C 'maco':19B,29B,83C 'malici':3A,54B,88C 'mcp':10A,20B,42B,101C,116C 'neon':2A,23B,27B,81C,115C 'oper':51B,109C 'opera':1A,22B,26B,80C,114C 'opera-neon':21B 'send':61B,98C 'sent':39B 'sourc':36B,73C 'take':7A,64B,92C 'use':58B 'verif':70C 'verifi':34B 'via':9A 'vulner':78C 'window':25B,31B,85C","nicknames":[],"mitigations":[],"who_affected":"People running Opera Neon on macOS or Windows with the MCP Hub extension at version 0.0.1 are affected, and a malicious browser extension installed on the same browser is the attack path. The sources do not say whether other MCP Hub versions or other browsers are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["browser","macos","mcp","medium","operaneon","other","windows"],"campaign_type":null,"search_a":"'-123139':14A,17A '-2026':13A,16A 'browser':4A 'control':8A 'cve':12A,15A 'extens':5A 'hub':11A 'malici':3A 'mcp':10A 'neon':2A 'opera':1A 'take':7A 'via':9A","search_b":"'browser':18B,50B,55B,68B 'built':48B 'built-in':47B 'command':38B,62B 'control':65B 'extens':44B,52B,56B 'hub':43B 'maco':19B,29B 'malici':54B 'mcp':20B,42B 'neon':23B,27B 'oper':51B 'opera':22B,26B 'opera-neon':21B 'send':61B 'sent':39B 'sourc':36B 'take':64B 'use':58B 'verifi':34B 'window':25B,31B","search_c":"'0.0.1':119C 'affect':113C 'allow':86C 'browser':89C,96C,108C 'built':106C 'built-in':105C 'channel':77C 'command':99C 'communic':76C 'control':93C 'extens':90C,110C,118C 'hub':102C,117C 'improp':69C 'issu':112C 'maco':83C 'malici':88C 'mcp':101C,116C 'neon':81C,115C 'oper':109C 'opera':80C,114C 'send':98C 'sourc':73C 'take':92C 'verif':70C 'vulner':78C 'window':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@opera.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123139","severity":null,"published_at":"2026-11-12T13:17:11+00:00","modified_at":"2026-11-12T13:17:11+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}