Iframe Sandbox Bypass in Whale Browser by NHN Corp

CVE-2026-120987

What is CVE-2026-120987?

The Whale Browser, developed by NHN Corp, is susceptible to a serious vulnerability that allows attackers to bypass the iframe sandbox restrictions in a dual-tab setup. This loophole can be exploited by threat actors to execute malicious scripts, potentially compromising user data and leading to unauthorized actions within the browser. Users are advised to update to version 5.39.412.57 or later to mitigate this security risk.

References