{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-123139","assignerOrgId":"9aee7086-24f5-48b4-9428-908ac90b8b54","state":"PUBLISHED","assignerShortName":"Opera","dateReserved":"2026-11-05T14:21:01.547Z","datePublished":"2026-11-12T12:22:07.291Z","dateUpdated":"2026-11-12T12:22:07.291Z"},"containers":{"cna":{"providerMetadata":{"orgId":"9aee7086-24f5-48b4-9428-908ac90b8b54","shortName":"Opera","dateUpdated":"2026-11-12T12:22:07.291Z"},"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-940","description":"CWE-940 Improper verification of source of a communication channel","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-36","descriptions":[{"lang":"en","value":"CAPEC-36 Using Unpublished Interfaces or Functionality"}]}],"affected":[{"vendor":"Opera","product":"Neon","platforms":["Windows","MacOS"],"modules":["MCP Hub extension"],"versions":[{"status":"affected","version":"1.0.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.","supportingMedia":[{"type":"text/html","base64":false,"value":"Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1."}]}],"references":[{"url":"https://security.opera.com/en/improper-verification-of-source-of-a-communication-channel-opera-security-advisories/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.8,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U"}}],"credits":[{"lang":"en","value":"maitai","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}