CVE-2026-123139
Browser Control via Malicious Extension in Opera Neon MCP Hub
Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.
CVSS 4.0 · 5.8 Medium
EPSS n/a
KEV · Not listed
Vendors
Products