CVE-2025-69234

The sandbox mechanism for iframe elements should restrict the capabilities of code running inside the embedded frame, preventing it from accessing resources of the parent browser context. In the described case (CWE-358 — Improperly Implemented Security Check), the verification of sandbox restrictions in the sidebar environment is improperly implemented, which allows it to be bypassed. An attacker can construct a specially crafted website or sidebar content to escape the isolated iframe context and gain access to resources they should not have access to.

An attacker can gain unauthorized access to sensitive data and modify resources or data outside the isolated iframe context, which corresponds to high impact on confidentiality and integrity (CVSS C:H/I:H).

The Whale browser should be updated to version 4.35.351.12 or newer. Detailed information is available at: https://cve.naver.com/detail/cve-2025-69234.html

Navercorp Whale Browser in all versions prior to 4.35.351.12.