Updates / Opera

Opera 140: Chromium 157 underneath, HTTPS-First turned on (and off on cdpfleet)

Stable Opera on the fleet is now 140.0.6074.17, on Chromium 157: HTTPS-First mode (kept off on cdpfleet), Protected Audience gone, TLS unchanged.

Opera stable · 139.0.6053.38 → 140.0.6074.17 · 2026-11-12

Opera released 140 to stable on 2026-11-10, and new opera sessions on the fleet now run 140.0.6074.17, the first 140 stable build in Opera's changelog (2026-11-10), instead of 139.0.6053.38. Opera 140 moves its Chromium base from 155.0.8059.85 to 157.0.8103.39, skipping 156, so web platform changes follow both Chrome 156 (Chrome 156 post) and Chrome 157 (Chrome 157 post). The biggest change for scrapers was that Opera sessions upgraded plain-HTTP URLs to HTTPS, the HTTPS-First mode Chromium 157 turns on; since 2026-11-13 the fleet switches it off for Opera too.

New

Chromium 157.0.8103.39 (Opera release notes, "Updated Chromium to 157.0.8103.39"; the browser reports the same in its full-version client hints).
From Chrome 156: CSS random() (a random value within a range) and scroll-snap-type: pair (a container that snaps to an element on one axis snaps to the same element on the other) (Chrome 156 release notes). Our feature probe finds both on 140 and not on 139.
From Chrome 157: CSS text-decoration-inset and Element.streamAppendHTML(), which parses HTML as it is written to a WritableStream (Chrome 157 release notes). Our probe finds both on 140 and not on 139.
WebTransport.reliability and the canvas srgb-linear colour space: both appear in our probe on 140 and not on 139, as they did in Chrome 157, though neither is in the Chrome 157 release notes. Chrome Platform Status lists the WebTransport reliability attributes for 158 and the linear canvas colour spaces for 155.
Opera's own changes: a security fix (CVE-2026-125350), crash fixes in split screen, the Page Info popup, permission prompts and tab handling, a fix for Safari import loading endlessly, dark extension icons visible again in dark mode, removing permissions from allowed sites in settings, and Linux fixes including drag and drop from the bookmarks bar (Opera release notes).

Removed or changed

Plain-HTTP URLs were upgraded to HTTPS (fixed on the fleet 2026-11-13): our test navigates to http://ip-api.com/json/?fields=status, an API that answers over plain HTTP. On 139.0.6053.38 (measured 2026-11-05) it loaded over HTTP: status 200, {"status":"success"}. On 140.0.6074.17 (measured 2026-11-11) the navigation ended at https://ip-api.com/json/?fields=status, and the page shows that server's HTTPS answer, a 403 with {"status":"fail"}, so our check counts it as not loaded. No warning page appeared. In the same snapshot run on 2026-11-11, Chrome 157.0.8103.50, Edge 157.0.4341.46 and Brave 1.99.56 loaded the same URL over HTTP (200), so it follows the browser, not the server. Opera's notes don't mention it; it matches the HTTPS-First balanced mode that Chromium 157 turns on, which upgrades http:// URLs when the site has HTTPS and blocks sites without HTTPS with net::ERR_BLOCKED_BY_CLIENT (Chrome 157 post). The enterprise policy that switches the mode off on cdpfleet nodes covers Chrome, Chromium, Brave and Edge, not Opera: this measurement was taken five days after it went live. We measured the upgrade only; we did not test an HTTP-only site on Opera 140.
Protected Audience is gone: navigator.joinAdInterestGroup exists on 139 and not on 140, as in Chrome 157. Chrome announced it would deprecate and remove the Protected Audience API (Chrome Platform Status). Our probes still find the Topics API (document.browsingTopics) and fenced frames on 140 (fenced frames only as stubs since Chromium 156, per the Chrome 156 release notes; don't rely on the feature test).
text-decoration-skip-spaces is gone: CSS.supports('text-decoration-skip-spaces', 'all') returned true on 139 (Chromium 155) and returns false on 140, as it did in Chrome 156 and 157. The Chrome release notes don't mention it, so treat it as unavailable.

What sites see / detection

User agent and client hints: Chrome/157.0.0.0 … OPR/140.0.0.0 in the user agent, and the Sec-CH-UA brands change from Opera 139, Chromium 155, Not(A:Brand 24 to Not-A.Brand 99, Opera 140, Chromium 157: a new placeholder brand, now listed first. An allowlist that matches the exact brand string needs updating.
TLS and HTTP/2 unchanged: the JA4 hash, the peetprint hash, the cipher and extension counts, the HTTP/2 fingerprint and the header order are identical to 139. (JA3 differs between the two snapshots, as it does between any two Chromium connections: Chromium shuffles its TLS extension order.)
Page fingerprint unchanged: WebGL, the canvas hash, plugins, the PDF viewer, languages, navigator.webdriver, window.chrome and the screen values read the same as on 139.
Bot checks unchanged: bot.sannysoft.com flagged one check (WebGL Renderer) before and after.

For scraping

Plain HTTP stays HTTP again on cdpfleet: since 2026-11-13 (13:45 UTC) every node turns HTTPS-First off for all Chromium-family browsers, Opera included, by adding it to Playwright's disabled features — re-measured on Opera 140 (Chromium 157.0.8103.39) the same day: http://ip-api.com/json/?fields=status and http://httpforever.com/ loaded over HTTP with 200 in two sessions. No change needed in your code; your own Opera 140 elsewhere will upgrade or block plain-HTTP URLs.
Launch options, the Playwright 1.60 client and wsUrl are the same, and every Playwright feature we test still works.
browser.version() reports 157.0.8103.39 (it was 155.0.8059.85 on 139): the Chromium version, not the Opera version.
If you match Sec-CH-UA brand strings or the full user agent somewhere (an allowlist, a test), update them to Opera 140 / Chromium 157.

Measured on the fleet

The same probe ran against 139.0.6053.38 and 140.0.6074.17 on the fleet, each when it went live: identity, TLS and HTTP/2 fingerprint, web platform features, Playwright features and bot checks. Host-dependent values (cores, memory, timings) are left out.

What the site sees: identity

	Before	After
User agent	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 OPR/139.0.0.0	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36 OPR/140.0.0.0
Client hint brands	Opera 139, Chromium 155, Not(A:Brand 24	Not-A.Brand 99, Opera 140, Chromium 157
Client hint full versions	Opera 139.0.6053.38, Chromium 155.0.8059.85, Not(A:Brand 24.0.0.0	Not-A.Brand 99.0.0.0, Opera 140.0.6074.17, Chromium 157.0.8103.39

Web platform features added

CSS text-decoration-inset (Chrome 157)
Element.streamAppendHTML (Chrome 157)
WebTransport.reliability (on stable from Chrome 157; listed for 158)
Canvas srgb-linear colour space (on stable from Chrome 157)
CSS random() (Chrome 156)
CSS scroll-snap-type: pair (Chrome 156)

Web platform features removed

Protected Audience (navigator.joinAdInterestGroup)
CSS text-decoration-skip-spaces (Chrome 155)

Plain HTTP pages

	Before	After
Plain HTTP loaded	true	false

Raw diff

{
  "engine": "opera",
  "label": "stable",
  "from": "139.0.6053.38",
  "to": "140.0.6074.17",
  "browser_version": {
    "before": "155.0.8059.85",
    "after": "157.0.8103.39"
  },
  "changes": {
    "identity": [
      {
        "field": "user_agent",
        "before": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 OPR/139.0.0.0",
        "after": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36 OPR/140.0.0.0"
      },
      {
        "field": "client_hint_brands",
        "before": "Opera 139, Chromium 155, Not(A:Brand 24",
        "after": "Not-A.Brand 99, Opera 140, Chromium 157"
      },
      {
        "field": "client_hint_full_versions",
        "before": "Opera 139.0.6053.38, Chromium 155.0.8059.85, Not(A:Brand 24.0.0.0",
        "after": "Not-A.Brand 99.0.0.0, Opera 140.0.6074.17, Chromium 157.0.8103.39"
      }
    ],
    "network": [],
    "features": {
      "added": [
        {
          "key": "css_text_decoration_inset",
          "label": "CSS `text-decoration-inset` (Chrome 157)"
        },
        {
          "key": "stream_append_html",
          "label": "`Element.streamAppendHTML` (Chrome 157)"
        },
        {
          "key": "webtransport_reliability",
          "label": "`WebTransport.reliability` (on stable from Chrome 157; listed for 158)"
        },
        {
          "key": "canvas_srgb_linear",
          "label": "Canvas `srgb-linear` colour space (on stable from Chrome 157)"
        },
        {
          "key": "css_random",
          "label": "CSS `random()` (Chrome 156)"
        },
        {
          "key": "css_scroll_snap_pair",
          "label": "CSS `scroll-snap-type: pair` (Chrome 156)"
        }
      ],
      "removed": [
        {
          "key": "protected_audience",
          "label": "Protected Audience (`navigator.joinAdInterestGroup`)"
        },
        {
          "key": "css_text_decoration_skip_spaces",
          "label": "CSS `text-decoration-skip-spaces` (Chrome 155)"
        }
      ]
    },
    "playwright": {
      "broke": [],
      "fixed": []
    },
    "fingerprint": [],
    "bot_checks": {
      "newly_failed": [],
      "newly_passed": [],
      "failed_before": 1,
      "failed_after": 1
    },
    "plain_http": [
      {
        "field": "plain_http_loaded",
        "before": true,
        "after": false
      }
    ],
    "launch": {
      "before_ms": 530,
      "after_ms": 661
    }
  },
  "host_dependent_ignored": [
    "hardware_concurrency",
    "device_memory",
    "launch/connect/page timings"
  ]
}