{"id":"CVE-2026-120987","kind":"vulnerability","aliases":["CVE-2026-120987"],"related":[],"title":"Whale Browser: iframe sandbox can be bypassed in dual-tab setups","description":"Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.","summary":"Whale Browser versions before 5.39.412.57 let an attacker bypass the iframe sandbox when two tabs are open. A successful bypass lets a malicious page escape the restrictions meant to isolate embedded content.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","other","whale-browser"],"not_affected_if":["version-5.39.412.57-or-later"],"how_to_check":"- Check the installed Whale Browser version in the browser's About page (version string not given in sources)","fix":"- Whale Browser: move to `5.39.412.57` or later","status":"open","published_at":"2026-11-03T07:18:21+00:00","first_seen_at":"2026-11-03T07:49:22+00:00","triaged_at":"2026-11-03T07:50:22+00:00","updated_at":"2026-11-03T07:50:22+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-03T07:50:22Z","model":"claude-haiku-5-5","output":{"fix":"- Whale Browser: move to `5.39.412.57` or later","reach":"unknown","title":"Whale Browser: iframe sandbox can be bypassed in dual-tab setups","impact":"medium","summary":"Whale Browser versions before 5.39.412.57 let an attacker bypass the iframe sandbox when two tabs are open. A successful bypass lets a malicious page escape the restrictions meant to isolate embedded content.","audience":"everyone","category":"other","nicknames":[],"who_cares":["whale-browser","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"malicious page escapes iframe sandbox restrictions in browser","analyst_note":"Sources give only the NVD description; check the vendor release notes for exploit conditions and whether the dual-tab bypass needs user interaction.","how_to_check":"- Check the installed Whale Browser version in the browser's About page (version string not given in sources)\n- unknown for any other check","plain_action":"Update Whale Browser to version 5.39.412.57 or later.","needs_analyst":true,"not_affected_if":["version-5.39.412.57-or-later"],"who_is_affected":"Whale Browser installations older than 5.39.412.57. The sources do not say which dual-tab conditions are required or whether any setting changes exposure. Teams that do not use Whale on managed machines can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4067,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120987':15A,18A '-2026':14A,17A '5.39.412.57':28B,59C 'allow':60C 'attack':31B,62C 'browser':2A,19B,23B,25B,57C 'bypass':7A,32B,43B,64C 'content':55B 'cve':13A,16A 'dual':10A,71C 'dual-tab':9A,70C 'embed':54B 'environ':73C 'escap':48B 'ifram':3A,34B,66C 'isol':53B 'let':29B,44B 'malici':46B 'meant':51B 'open':40B 'page':47B 'restrict':50B 'sandbox':4A,35B,67C 'setup':12A 'success':42B 'tab':11A,38B,72C 'two':37B 'version':26B 'whale':1A,22B,24B,56C 'whale-brows':21B","nicknames":[],"mitigations":[],"who_affected":"Whale Browser installations older than 5.39.412.57. The sources do not say which dual-tab conditions are required or whether any setting changes exposure. Teams that do not use Whale on managed machines can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Whale Browser to version 5.39.412.57 or later.","pkeys":[],"ptokens":[],"labels":["browser","other","unknown","whalebrowser"],"first_public_at":"2026-11-03T07:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120987","severity":null,"published_at":"2026-11-03T07:18:21+00:00","modified_at":"2026-11-03T07:18:21+00:00","first_seen_at":"2026-11-03T07:49:22+00:00","fetched_at":"2026-11-03T07:49:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}