Oct 31, 2025
Brave discloses hidden-HTML prompt injection in Opera Neon, fixed within a week of re-engagement
Brave reports that concealed elements in page markup could instruct Opera Neon's assistant, when asked about a page, to pull data such as email addresses from the user's other logged-in sites. Reported via Bugcrowd on 2025-10-14 and initially closed as not applicable, Opera then deployed a fix on 2025-10-21 that Brave confirmed.