What is the CVSS score of CVE-2025-62584?

CVE-2025-62584 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Naver Whale are affected by CVE-2025-62584?

Naver Whale browser versions prior to 4.33.325.17 contain a same-origin policy bypass that, under a specific dual-tab condition, allows unauthenticated attacker-controlled content to read data from…

How to fix or mitigate CVE-2025-62584?

Within 24 hours, inventory all endpoints running Naver Whale browser (any build prior to 4.33.325.17), especially those used for accessing sensitive internal or customer data, and instruct users to avoid Naver Whale for high-risk or multi-tab browsing. Within 7 days, implement compensating controls such as remote browser isolation or virtualized browsing for Naver Whale, restrict its use for critical applications, enable enhanced monitoring for cross-origin data leakage, and contact Naver support to obtain a timeline for a fixed build while monitoring advisories for release of version 4.33.325.17 or later. Within 30 days, evaluate alternative browsers for affected users, and if a patched version becomes available, deploy it immediately via automated update mechanisms; if no patch is released, phase out Naver Whale from sensitive environments and document residual risk acceptance for remaining use cases.

Naver Whale CVE-2025-62584

HIGH

Origin Validation Error (CWE-346)

2025-10-16 cve@navercorp.com

Authentication Bypass Whale

7.5

CVSS 3.1 · Vendor: navercorp

Severity by source

Vendor (navercorp) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.4 HIGH

Browser SOP bypass needs the victim to visit attacker content (UI:R) and crosses an origin security boundary (S:C), primarily exposing cross-origin data (C:H) rather than integrity.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (navercorp).

CVSS VectorVendor: navercorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 16:09 vuln.today

CVE Published

Oct 16, 2025 - 07:15 cve.org

HIGH 7.5

DescriptionCVE.org

Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.

AnalysisAI

Same-Origin Policy bypass in Naver Whale browser builds before 4.33.325.17 lets attacker-controlled content cross the origin boundary and read data belonging to another page, but only when a specific dual-tab condition is present. Exploitation is client-side and, per our assessment, requires the victim to browse to attacker content (user interaction); the vendor's own vector claims UI:N and integrity-only impact, whereas our assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, i.e. a scope-escaping confidentiality breach rather than a page-tampering bug. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.21% (10th percentile), consistent with a narrow, targeted issue rather than a broad exploitation campaign.

Technical ContextAI

The underlying weakness is CWE-346, Origin Validation Error, in the browser's handling of cross-origin boundaries. Browsers depend on the Same-Origin Policy to decide whether one document may script or read another; a flaw in that validation logic means two documents that should be isolated are instead treated as mutually accessible. Here the failure is specifically tied to a 'dual-tab environment' - a state in which a second tab is open alongside the attacker's page inside a vulnerable Whale build - which strongly indicates an error in how the browser process associates origins/contexts across tabs or windows rather than a straightforward rendering-path bug. Per our independent assessment the failure produces a scope change (S:C) with high confidentiality impact (C:H), aligning with the classic consequence of a Same-Origin Policy bypass: unauthorized reading of another origin's content, session context, or authenticated state. The CPE string cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:* uses a wildcard version, so every Whale release below the fix threshold is treated as affected; the default wildcard application target rules out server-side or non-browser deployment targets, confirming this is client software only, and it does not affect other browsers built on the same engine because the flaw is in Whale's own origin-checking logic.

RemediationAI

The primary fix is to upgrade Naver Whale to version 4.33.325.17 or later, the first build outside the affected range per the vendor description; the vendor advisory at https://cve.naver.com/detail/cve-2025-62584.html should be consulted for the definitive build numbers and any vendor-specific guidance, and enterprises should enforce the minimum version through their software-management or auto-update tooling since Whale ships with a self-update path. Because this is a client-side Same-Origin Policy bug, there is no server-side patch or WAF rule that removes the risk - blocking the browser at the network edge is ineffective against a locally installed client. Where upgrading cannot be done immediately, compensating controls are constrained and come with real trade-offs: keep Whale at the newest available build even if below the threshold, treat the browser as unsuitable for authenticated or business-critical sessions until it is patched, and pair that with browser hygiene controls such as script blockers and aggressive tab-hygiene policies that reduce the likelihood of attacker content and a second tab coexisting in the same session, accepting degraded usability on sites that depend on cross-tab or scripted flows. The low EPSS (0.21%, 10th percentile) and absence of KEV or public exploit code mean these measures can be scheduled rather than emergency-prioritized, but the version floor should still be enforced fleet-wide.