Live › vulnerability › CVE-2026-120987
Whale Browser versions before 5.39.412.57 let an attacker bypass the iframe sandbox when two tabs are open. A successful bypass lets a malicious page escape the restrictions meant to isolate embedded content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 07:49 UTC. All times on this page are UTC.
Whale Browser installations older than 5.39.412.57. The sources do not say which dual-tab conditions are required or whether any setting changes exposure. Teams that do not use Whale on managed machines can likely skip it.
No product ranges from the sources yet.
5.39.412.57 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
This page as .md · .json · in your agent: get_signal("CVE-2026-120987")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.