CVE-2026-120987 in Whale Browser
Summary
by MITRE • 11/03/2026
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Whale Browser prior to version 5.39.412.57 represents a significant security flaw within the browser's handling of cross-origin resource sharing and frame isolation mechanisms. Specifically, this issue pertains to an iframe sandbox bypass that occurs under specific conditions involving dual-tab environments. Modern web browsers employ strict same-origin policies and sandbox attributes for iframes to prevent malicious scripts from accessing sensitive data or performing actions on behalf of users in other contexts. The sandbox attribute is designed to restrict the capabilities of content loaded within the frame, such as preventing form submission, script execution, or access to the parent window's DOM. However, in this specific implementation flaw, the isolation boundaries between tabs and frames are not correctly enforced when multiple tabs are active simultaneously.
The technical root cause lies in how the browser engine manages context separation during tab switching or concurrent rendering processes. When a user interacts with two different tabs where one contains an iframe attempting to access resources from another origin, the security checks intended to block unauthorized cross-origin requests fail due to improper state management within the browsing session. This allows scripts running inside the sandboxed iframe to escape its restricted environment and interact with elements or data in the parent window or other frames that should remain inaccessible. The dual-tab aspect suggests that the vulnerability may be triggered by race conditions or context leakage when the browser attempts to synchronize UI updates or resource loading across multiple active windows, effectively weakening the isolation guarantees provided by the sandbox attribute.
From an operational impact perspective, this vulnerability enables attackers to conduct sophisticated cross-site scripting attacks and data exfiltration campaigns. An attacker could craft a malicious webpage that loads a seemingly benign iframe with restricted permissions. Due to the bypass, scripts within that iframe can read sensitive information from the parent page, such as session cookies, authentication tokens, or personal user data stored in local storage. Furthermore, the ability to manipulate the DOM of the parent window allows for clickjacking attacks where users are tricked into performing unintended actions on trusted websites. This undermines the fundamental trust model of web browsing and can lead to account takeover, financial fraud, or unauthorized access to private corporate networks if used within enterprise environments relying on browser-based applications.
This vulnerability aligns with CWE-200, which classifies it as an Information Exposure Vulnerability, specifically detailing how improper restriction of information flow allows attackers to gain insight into system internals. It also maps closely to MITRE ATT&CK technique T1536, known as Prepare Remote System Interaction, where adversaries use browser vulnerabilities to establish a foothold or exfiltrate data through legitimate web mechanisms. The dual-tab context further complicates detection and mitigation efforts because the exploit relies on specific user interaction patterns involving multiple browsing contexts.
To mitigate this risk, users must immediately update Whale Browser to version 5.39.412.57 or later, where these sandbox enforcement logic errors have been corrected by the development team. Until an upgrade is possible, administrators should enforce strict content security policies that disable iframe embedding from untrusted sources and restrict script execution in embedded frames wherever feasible. Additionally, enabling browser features such as site isolation can help limit the blast radius of any potential exploitation by ensuring that each origin runs in a separate process, thereby reducing the likelihood of context leakage between tabs or frames. Regular patching cycles and monitoring for unusual network traffic originating from browser processes are recommended defensive measures to detect attempts to exploit this class of vulnerabilities.