CVE-2026-123139

MediumCVSS 5.8/10Last modified Nov 12, 2026

Description

Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.

Metrics

CVSS 4.0 5.8/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-940

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Opera	Neon	1.0.0

References

https://security.opera.com/en/improper-verification-of-source-of-a-communication-channel-opera-security-advisories/

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-123147.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbir CVE-2026-1231454.4The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it save CVE-2026-1231485.3Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This is CVE-2026-123159.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thun CVE-2026-1231517.5A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffe CVE-2026-1231588.1sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related CVE-2026-123169.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-123177.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231784.5An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to t CVE-2026-1231795.5An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 all CVE-2026-123187.3Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231808.8A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi ne