CVE-2020-9754

NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode...

CVE-2020-9754

Affected software: NAVER Whale browser (mobile) prior to 1.10.6.2. Vulnerability: Bypass of the browser unlock function via incognito/stealth mode. Root cause: Issue in the browser’s locking feature that allows bypass when in incognito. Impact: Adversaries could access the app without unlocking c...

CVE-2020-9754: Improper Access Control

NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode...

PT-2022-9078

Name of the Vulnerable Software and Affected Versions NAVER Whale browser mobile app versions prior to 1.10.6.2 Description The issue allows an attacker to bypass the browser unlock function via incognito mode. Recommendations For versions prior to 1.10.6.2, update to version 1.10.6.2 or later to...

NAVER Whale browser 安全漏洞

Naver Whale Browser is a web browser from Naver, a South Korean company that supports user-defined interfaces. A security vulnerability exists in NAVER Whale browser versions prior to 1.10.6.2, which stems from a problem with the application browser locking feature. The vulnerability can be...

MAL-2022-6546 Malicious code in theme-whale-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c40def8d41c4b7ebb0169b850854b2a3cbdbd547e0e5e4ab2294ecf310c1b471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in theme-whale-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c40def8d41c4b7ebb0169b850854b2a3cbdbd547e0e5e4ab2294ecf310c1b471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Naver Whale Browser Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in versions prior to 3.12.129.18 of Naver Whale Browser, a web browser from Naver Korea that supports user-defined interfaces, due to a lack of data validation filtering of user-supplied and output data. An attacker could exploit this to allow extension...

CVE-2022-24072

The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool...

CVE-2022-24073

The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store...

CVE-2022-24075

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files...

CVE-2022-24074

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises...

CVE-2022-24075

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files...

CVE-2022-24073

The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store...

CVE-2022-24074

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises...

CVE-2022-24072

The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool...

CVE-2022-24073

The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store...

CVE-2022-24075

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files...

CVE-2022-24074

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises...

Default credentials

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises...