CVE-2026-123139

An installed extension could take control of Opera's browser operator

Opera · Opera Neon MCP Hub and Browser Operator

First documented disclosure · Review checkpoint

Summary

MCP Hub failed to verify which extension originated a command. Commands could operate the browser with the built-in operator's privileges.

Severity and exploitation evidence

Medium · 5.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

MCP Hub failed to verify which extension originated a command.

Conditions required

A malicious browser extension was present in Opera Neon on Windows or macOS.

Potential impact

Commands could operate the browser with the built-in operator's privileges.

Affected versions and configurations

MCP Hub extension 0.0.1 on macOS and Windows, per Opera’s advisory.

Fix and mitigation status

Opera names no corrected build in the notice.

Practical next steps

Remove untrusted extensions and check Opera’s advisory for a corrected MCP Hub build.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The vendor identifies the MCP Hub component version separately from the Opera Neon product version. Its notice gives no corrected component release. The CVE record was published on 2026-11-12.

Sources