What is the CVSS score of CVE-2025-62583?

CVE-2025-62583 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Whale Browser are affected by CVE-2025-62583?

Whale Browser installations at versions prior to 4.33.325.17 carry a sandbox-escape defect in the browser's dual-tab (split-view) mode that could allow attacker-controlled web content to reach beyond…

How to fix or mitigate CVE-2025-62583?

Within 24 hours, confirm whether Whale Browser is present anywhere in the estate (endpoint inventory, software asset management, and help-desk tickets) and identify any users relying on the dual-tab split-view workflow, then notify those users in writing to avoid dual-tab mode for general web browsing and to confine the browser to a defined set of trusted internal sites; no vendor-released patch is identified at time of analysis, so this is a usage restriction, not a remediation. Within 7 days, push an enterprise policy or configuration profile that disables or blocks split-view mode where Whale Browser's management interface allows it, enforce the browser as non-default and out-of-scope for untrusted or internet-facing content, isolate any endpoint that must keep using it, and confirm whether the vendor's 4.33.325.17 build (the version at which the affected range ends) is available for pilot or staged deployment against the advisory. Within 30 days, complete migration of affected business workflows to a supported alternative browser, re-verify that no instance below 4.33.325.17 remains reachable by employee traffic, and re-run the risk assessment - including a decision to formally accept residual risk if any Whale Browser usage is retained - while tracking the vendor advisory for a released fix and for any change in exploitation status.

Whale Browser CVE-2025-62583

CRITICAL

Improperly Implemented Security Check for Standard (CWE-358)

2025-10-16 cve@navercorp.com

Information Disclosure Whale Naver Navercorp

9.8

CVSS 3.1 · Vendor: navercorp

Severity by source

Vendor (navercorp) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.7 MEDIUM

Client-side browser flaw needs user to load malicious content (UI:R) only in dual-tab mode (AC:H); sandbox escape crosses a security boundary (S:C) with limited cross-frame confidentiality/integrity impact, not full RCE.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (navercorp).

CVSS VectorVendor: navercorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 01, 2026 - 00:40 vuln.today

tag: Naver added

Analysis Generated

Sep 30, 2026 - 23:56 vuln.today

CVE Published

Oct 16, 2025 - 07:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.

AnalysisAI

Whale Browser versions prior to 4.33.325.17 allow a crafted sandboxed iframe to escape its sandbox restrictions, giving attacker-controlled web content cross-frame access and navigation reach beyond the intended boundary when the browser is used in its dual-tab (split-view) mode; unauthenticated remote attackers can trigger this, but the victim must interact by loading hostile content in that specific mode. The vendor-supplied CVSS of 9.8 (scope unchanged, C:H/I:H/A:H) overstates the defect: the authoritative independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, describing a client-side sandbox escape with limited confidentiality and integrity impact and no confirmed host-level code execution. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.50% (41st percentile).

Technical ContextAI

Naver Whale is a Chromium-based browser, and the flaw is classified as CWE-358 (Improperly Implemented Security Check for Standard), meaning the browser fails to correctly enforce a defined web-platform security rule - here the HTML iframe sandbox attribute, which is supposed to isolate embedded content from its parent browsing context. In Whale's vendor-specific dual-tab/split-view environment, the enforcement of that sandbox boundary breaks down, allowing embedded content to reach across frame boundaries and manipulate navigation in ways the sandbox should prevent. The two published vectors diverge notably: the vendor vector assigns S:U with C:H/I:H/A:H (9.8), while the independent assessment assigns S:C with C:L/I:L/A:N and adds AC:H and UI:R, reflecting that the escape requires a non-default browsing state and user interaction and that the demonstrated effect is a restriction bypass rather than full compromise of the host. Note that CWE-358 describes a defect in implementing a protective standard, so the practical impact is bounded by what the escaped frame can reach, not by the top-line CVSS number.

RemediationAI

Vendor-released patch: 4.33.325.17 - upgrade Naver Whale Browser to 4.33.325.17 or later, and confirm availability through the vendor advisory at https://cve.naver.com/detail/cve-2025-62583.html and the browser's built-in update channel. Where immediate upgrade is not possible, the most directly effective compensating control is to avoid using the dual-tab/split-view mode while browsing untrusted or externally linked content, or to disable that feature entirely if the deployment permits, accepting the loss of the split-view productivity workflow as the trade-off; additionally, restrict exposure by only opening known-good sites in Whale and using a hardened secondary browser for untrusted links. Because the defect is client-side and triggered by rendered web content, network-layer filters and generic defense-in-depth controls offer limited protection, and no vendor-documented workaround beyond upgrading has been identified in the available data.