Arbitrary JavaScript Injection in Whale Browser Extensions
CVE-2022-24072

6.1MEDIUM

Key Information:

Vendor

Naver

Status
Naver Whale Browser
Vendor
CVE Published:
17 March 2022

What is CVE-2022-24072?

A vulnerability in the devtools API of the Whale browser prior to version 3.12.129.18 permits extension developers to inject arbitrary JavaScript into the extension store web page through the devtools.inspectedWindow interface. This flaw can lead to unauthorized extensions being downloaded or uploaded when users access the developer tools, posing significant security risks.

Affected Version(s)

NAVER Whale browser < 3.12.129.46

References

https://cve.naver.com/detail/cve-2022-24072
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Young Min Kim
.