Whale Browser versions older than 5.39.412.57 contain a flaw that permits an attacker to escape the iframe sandbox when two tabs are used together. The bypass allows the attacker to execute code or read data that should otherwise be restricted by the sandbox, potentially compromising the integrity of web content displayed in the victim’s browser.

NAVER Whale Browser, all releases prior to 5.39.412.57, as listed by the vendor.

Because the flaw requires an attacker to load a malicious web page in a dual‑tab environment, the attack vector is driven by user interaction. The CVSS score is not provided, but the absence of an EPSS entry and the lack of listing in the CISA KEV catalog suggest that automated exploitation is unlikely. Nonetheless, the failure to enforce iframe sandboxing represents a significant security weakness exposed to potentially all users of the affected browser over a wide time window.