CVE-2025-69234
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
Risk Assessment
The risk for the organization is the possibility of breaking browser isolation, potentially leading to unauthorized code execution or access to sensitive data in the browser context.
Recommendation
It is recommended to immediately update the Whale browser to the latest version that includes the fix.
Other vulnerabilities in Whale browser
See all- CVE-2025-62583Critical
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- CVE-2026-120987Low risk· EPSS 1%
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
- CVE-2025-69235High
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
- CVE-2025-62585High
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- CVE-2025-62584High
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. This may enable unauthorized access to data between tabs.
Original NVD description (English source)
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS