{"affected":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS"],"product":"Neon","source":"CNA: Opera","vendor":"Opera","versions":[{"status":"affected","version":"1.0.0","versionType":"custom"}]}],"cveId":"CVE-2026-123139","cwes":["CWE-940"],"description":"Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.8,"severity":"medium","source":"CNA: Opera","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U","version":"4.0"}],"modifiedAt":1794486127291,"publishedAt":1794486127291,"references":[{"source":"CNA: Opera","tags":[],"url":"https://security.opera.com/en/improper-verification-of-source-of-a-communication-channel-opera-security-advisories/"}],"remediation":[],"revision":"cf1e010f2eb379f728fdf8071ee3b548ec772ef005a0655cd5cc446f11bc82ac","sources":[{"modifiedAt":1794486127291,"name":"CNA: Opera","retrievedAt":1794488914131,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123139"}],"ssvc":null,"status":"published","title":"CVE-2026-123139","updatedAt":1794488914131}