What is the CVSS score of CVE-2025-62585?

CVE-2025-62585 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Naver Whale are affected by CVE-2025-62585?

Naver Whale browser versions before 4.33.325.17 contain a high-severity content security policy integrity bypass that can affect users who browse attacker-influenced content while using a specific…

How to fix or mitigate CVE-2025-62585?

Within 24 hours, inventory Naver Whale browser installations and identify any version below 4.33.325.17; notify affected users and restrict Naver Whale for sensitive web sessions or dual-tab workflows where feasible. Within 7 days, confirm whether the vendor has released 4.33.325.17 or later, enforce automatic browser updates, and deploy web filtering to reduce access to untrusted or attacker-influenced content for users who must continue using Naver Whale. Within 30 days, reassess exposure, validate that all affected endpoints have moved to 4.33.325.17 or later if available, migrate high-risk users to an alternative supported browser, and review user-awareness guidance for suspicious browsing scenarios.

Naver Whale CVE-2025-62585

HIGH

Improperly Implemented Security Check for Standard (CWE-358)

2025-10-16 cve@navercorp.com

Authentication Bypass Whale

7.5

CVSS 3.1 · Vendor: navercorp

Severity by source

Vendor (navercorp) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Requires a specific scheme plus a non-default dual-tab setup (AC:H) and a victim browsing to attacker content (UI:R); CSP bypass affects integrity only, so C:N/A:N.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (navercorp).

CVSS VectorVendor: navercorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 16:08 vuln.today

CVE Published

Oct 16, 2025 - 07:15 cve.org

HIGH 7.5

DescriptionCVE.org

Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.

AnalysisAI

Content Security Policy bypass in the Naver Whale browser before 4.33.325.17 lets remote, unauthenticated attackers defeat a site's CSP integrity protections, but only when the victim browses to attacker-influenced content while operating a specific dual-tab configuration. The vendor scores this 7.5, while the assessed vector (AV:N/AC:H/PR:N/UI:R, integrity-only, C:N/I:H/A:N) reflects those non-default prerequisites; EPSS is 0.37% (29th percentile) and no public exploit has been identified at time of analysis.

Technical ContextAI

Naver Whale is a Chromium-based web browser developed by Naver and used predominantly in South Korea. The root cause maps to CWE-358 (Improperly Implemented Security Check for Standard): the browser's Content Security Policy enforcement fails to validate resources requested through a particular URL scheme in a 'dual-tab environment', so content that a page's CSP directives should have blocked can still load or execute. CSP is the standard client-side control that restricts script, style, frame, and connect sources, so a bypass weakens the primary defense-in-depth layer against cross-site scripting and content injection. The CPE cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:* confirms every release prior to 4.33.325.17 is in scope. Per the assessed vector the impact is integrity-only (C:N/I:H/A:N) with no confidentiality or availability effect, and exploitation is complicated (AC:H) rather than trivial despite the vendor's AV:N/AC:L/UI:N rating.

RemediationAI

Vendor-released patch: upgrade to Naver Whale 4.33.325.17 or later, per https://cve.naver.com/detail/cve-2025-62585.html. No other technical fix is documented, and because the bypass is reachable only via a specific URL scheme inside a dual-tab configuration, interim mitigations are usage restrictions: avoid the offending dual-tab browsing pattern, refrain from browsing untrusted or attacker-influenceable sites in Whale until updated, or conduct sensitive sessions in a different browser - each carries the trade-off of user-compliance dependence and reduced convenience. Administrators can enforce the fixed build through browser update policy or software-deployment controls so users cannot continue on pre-4.33.325.17 builds; site-side CSP tuning will not close this browser-level enforcement gap, and no compensating control fully restores the CSP guarantee on unpatched clients.