What is the CVSS score of CVE-2025-69234?

CVE-2025-69234 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Naver Whale are affected by CVE-2025-69234?

Naver Whale browser versions prior to 4.35.351.12 contain an iframe sandbox escape that can expose cross-origin data when users interact with hostile sidebar content.

How to fix or mitigate CVE-2025-69234?

Within 24 hours, inventory all endpoints for Naver Whale browser installations and identify any running versions prior to 4.35.351.12; instruct users to upgrade to 4.35.351.12 or later immediately (Vendor-released patch: 4.35.351.12). Within 7 days, enforce browser update policies through endpoint management, restrict or block use of older Whale versions, and audit sidebar iframe configurations for untrusted content sources. Within 30 days, verify complete migration to 4.35.351.12 or later, review browser security baselines for iframe sandbox isolation, and monitor for anomalous cross-origin data access or data exfiltration attempts.

Naver Whale CVE-2025-69234

CRITICAL

Improperly Implemented Security Check for Standard (CWE-358)

2025-12-30 cve@navercorp.com

Information Disclosure Whale Naver Navercorp

9.1

CVSS 3.1 · Vendor: navercorp

Severity by source

Vendor (navercorp) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Remote web content with low complexity and no auth, but loading the malicious iframe needs user interaction (UI:R); sandbox escape crosses a boundary (S:C); impact is mainly confidentiality (C:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (navercorp).

CVSS VectorVendor: navercorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 05, 2026 - 17:40 vuln.today

tag: Naver added

Analysis Generated

Oct 05, 2026 - 17:30 vuln.today

CVE Published

Dec 30, 2025 - 02:16 cve.org

CRITICAL 9.1

DescriptionCVE.org

Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.

AnalysisAI

An iframe sandbox escape in Naver Whale browser (navercorp:whale) versions prior to 4.35.351.12 lets attacker-controlled content loaded inside a sidebar iframe break out of its sandbox and reach data or capabilities that should have been isolated from it. Exploitation requires a victim running an affected Whale build who loads hostile content into that sidebar iframe context, making it a client-side issue that depends on user interaction rather than a network-reachable, unauthenticated attack; users on 4.35.351.12 or later are not affected. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, though the confidentiality impact (sandbox escape enabling cross-origin data exposure) keeps this high severity. Note the input's CVSS 9.1 vector assumes UI:N and S:U, whereas our reassessment applies UI:R and S:C with only low integrity impact, so the practical base score is lower than the headline number suggests.

Technical ContextAI

The flaw is classified as CWE-358, Improperly Implemented Security Check for Standard, which in a browser context typically means the engine enforces a standardized isolation control - here the HTML iframe sandbox - in a way that is incomplete or bypassable. Naver Whale implements a proprietary sidebar environment that hosts web content in an embedded frame, and the sandbox check governing that frame's navigation, origin, or permission boundaries is not correctly applied, so a frame that should remain sandboxed can escape into a less restricted context. Because the affected component is client-side rendering logic rather than a remote service, the attack surface is the content a user chooses to render; the CPE cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:* indicates the advisory covers the entire Naver Whale product line up to the fixed build, not a specific plugin or OS-specific package. The assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) differs meaningfully from the input vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N): the scope change to S:C is consistent with a genuine sandbox-escape class effect where the vulnerable component can affect resources beyond its security scope, but the requirement for user interaction and the absence of a demonstrated high-integrity/high-availability impact argue against the input's 9.1 rating and its UI:N assumption.

RemediationAI

Vendor-released patch: 4.35.351.12 - upgrade Naver Whale to version 4.35.351.12 or later, which is the version boundary named in the advisory at https://cve.naver.com/detail/cve-2025-69234.html, and confirm the installed build via the browser's About/version page since Whale updates can lag on managed or pinned deployments. Until every affected endpoint is on 4.35.351.12 or newer, the effective compensating control is to stop untrusted web content from entering the sidebar environment - restrict sidebar use to vetted, first-party or internal sources and avoid opening links, extensions, or embedded pages from external or low-trust origins in a sidebar frame, accepting the loss of sidebar convenience as the trade-off. Because the weakness is an enforcement flaw in the sandbox rather than a configurable setting, there is no documented registry or policy switch that disables the vulnerable code path short of removing sidebar functionality entirely through enterprise policy or by not deploying the browser for untrusted browsing; content-blocking or extension-based filtering of sidebar frames is a partial mitigation at best and should not be treated as equivalent to patching.