CVE-2025-69235CWE-346

CVE-2025-69235

High · published December 30, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

⚡ A crafty bypass of the Same-Origin Policy lurks in Whale browser versions before 4.35.351.12, and it could mean trouble in your sidebar! 🔍 Think of it like a sneaky delivery person who, instead of dropping your package at your door, starts handing out all your neighbors' mail without permission. This vulnerability lets attackers access resources across different origins as if they had the right to! With this vulnerability, an attacker could potentially steal sensitive data or inject malicious content from an unauthorized source, putting users' privacy and security at risk. It’s like opening a window to strangers in a crowded café, enabling them to overhear your conversations and even manipulate your orders!

Put simply

Think of it like a sneaky delivery person who, instead of dropping your package at your door, starts handing out all your neighbors' mail without permission. This vulnerability lets attackers access resources across different origins as if they had the right to! This issue allows an attacker to bypass the browser's Same-Origin Policy specifically in the sidebar environment, meaning they can interact with content from different origins unexpectedly. This could lead to unauthorized access or actions that would typically be restricted.

What to do

With this vulnerability, an attacker could potentially steal sensitive data or inject malicious content from an unauthorized source, putting users' privacy and security at risk. It’s like opening a window to strangers in a crowded café, enabling them to overhear your conversations and even manipulate your orders! To protect yourself, update your Whale browser to version 4.35.351.12 or later immediately. Additionally, review any third-party scripts and resources that might operate in the sidebar to ensure they don’t exploit this flaw. Regularly audit browser security settings as well! You've got this! By taking these steps, you can secure your browsing experience and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2025-12-30T07:16Z
Affected products (1)
ProductVersionsFixed in
navercorp/whale< 4.35.351.124.35.351.12
References (1)
EPSS history
Timeline
  • 30 DEC 01:22Z
    Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment
    cvelistv5