Whale Browser
CVE-2025-69235
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-delivered content with no privileges, but the victim must engage the sidebar (UI:R); an SOP bypass primarily exposes cross-origin data (C:H) with limited integrity effect.
Primary rating from Vendor (navercorp).
CVSS VectorVendor: navercorp
Lifecycle Timeline
4DescriptionCVE.org
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
AnalysisAI
Same-Origin Policy bypass in Whale Browser versions before 4.35.351.12 allows unauthenticated remote attackers to access cross-origin data within the sidebar panel, though practical exploitation requires the victim to open the sidebar with attacker-influenced content. An independent assessment scores this as CVSS 7.5 with a modified vector (UI:R, C:H/I:L) reflecting the need for user interaction and the potential for confidentiality impact, while the vendor rates it 7.5 with UI:N and pure integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Whale Browser is a Chromium-based web browser developed by Naver. The sidebar is a built-in panel that renders web content (e.g., messenger, music, notes) within the browser UI. The vulnerability stems from improper origin validation (CWE-346) in the sidebar environment, allowing a malicious page loaded in the sidebar to bypass the Same-Origin Policy and access resources from other origins. The affected CPE is cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*, indicating all versions prior to the fixed release. The root cause is insufficient enforcement of origin isolation specifically within the sidebar rendering context, not the main browsing surface.
RemediationAI
Vendor-released patch: upgrade to Whale Browser version 4.35.351.12 or later. This is the exact fix version released by the vendor. If immediate upgrade is not possible, avoid using the sidebar to load untrusted web content, or disable the sidebar feature if the browser allows it; however, disabling the sidebar may remove functionality and is not a complete mitigation. Users should also be cautious of links that cause content to render in the sidebar. Refer to the vendor advisory at https://cve.naver.com/detail/cve-2025-69235.html for more details. No other official workarounds are documented.
Whale Browser versions prior to 4.33.325.17 allow a crafted sandboxed iframe to escape its sandbox restrictions, giving
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted java
Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from t
An iframe sandbox escape in Naver Whale browser (navercorp:whale) versions prior to 4.35.351.12 lets attacker-controlled
The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. Rated high severity (CVSS 8.1), this vulne
The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking. Rated high severity (CVSS 7.8), this vuln
Content Security Policy bypass in the Naver Whale browser before 4.33.325.17 lets remote, unauthenticated attackers defe
Same-Origin Policy bypass in Naver Whale browser builds before 4.33.325.17 lets attacker-controlled content cross the or
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any
Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could ac
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into th
Same weakness CWE-346 – Origin Validation Error
View allShare
External POC / Exploit Code
Leaving vuln.today