A critical Same-Origin Policy bypass vulnerability in the NAVER Whale browser allows unauthenticated attackers to potentially compromise user data integrity.

The flaw is an Origin Validation Error (CWE-346) occurring within a dual-tab environment. It allows an unauthenticated attacker to bypass the Same-Origin Policy, which is a fundamental security mechanism for web browsers.

The ability to bypass the Same-Origin Policy poses a significant risk to user data and session security. By circumventing these protections, an attacker could potentially execute unauthorized actions on behalf of a user within affected web applications or access sensitive information across different origins. Given the CVSS score of 7.5, this is categorized as a High severity issue that requires immediate attention to prevent unauthorized data manipulation.

Immediate Action: Update the NAVER Whale browser to version 4.33.325.17 or later to implement the necessary origin validation fixes.

Proactive Monitoring: Security teams should monitor browser-based traffic for anomalous cross-origin requests or unexpected interactions between browser tabs that may indicate exploitation attempts.

Compensating Controls: Ensure that all critical web applications enforce strict Content Security Policy (CSP) headers, which can provide an additional layer of defense against cross-origin attacks even if the browser itself is vulnerable.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the ease of exploitation, necessitates a swift response. Organizations should prioritize updating all instances of the NAVER Whale browser to version 4.33.325.17 immediately. Failure to patch may expose users to cross-origin attacks that could compromise sensitive web sessions and integrity.