CVE-2025-62583

The error classified as CWE-358 (Improperly Implemented Security Check for Standard) consists of improper implementation of the sandbox isolation mechanism for the iframe element in the context of the dual-tab environment of the Whale browser. An attacker can prepare appropriate conditions in an environment with two tabs, which cause the restrictions imposed by the iframe sandbox to not be properly enforced. As a result, code executed inside the isolated frame can escape its boundaries.

Successful exploitation of the vulnerability allows an attacker to bypass iframe sandbox isolation mechanisms, which may result in unauthorized access to browser resources, data from other tabs, or execution of unintended code outside the sandbox environment.

The Whale Browser should be updated as soon as possible to version 4.33.325.17 or newer, in which the vulnerability has been fixed. Detailed information is available in the vendor's references at https://cve.naver.com/detail/cve-2025-62583.html

Navercorp Whale Browser in versions prior to 4.33.325.17