CVE-2025-62583
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
Risk Assessment
An attacker can bypass browser isolation mechanisms, potentially leading to data security breaches and unauthorized actions.
Recommendation
Update Whale Browser to version 4.33.325.17 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Whale Browser
See all- CVE-2025-69234Critical
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
- CVE-2026-120987Low risk· EPSS 1%
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
- CVE-2025-69235High
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
- CVE-2025-62585High
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- CVE-2025-62584High
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. This may enable unauthorized access to data between tabs.
Original NVD description (English source)
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS