{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-120987","assignerOrgId":"f9629fae-ca2e-4fbf-9785-3ed86476aef6","state":"PUBLISHED","assignerShortName":"naver","dateReserved":"2026-11-03T06:34:49.544Z","datePublished":"2026-11-03T06:42:16.816Z","dateUpdated":"2026-11-03T06:42:16.816Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f9629fae-ca2e-4fbf-9785-3ed86476aef6","shortName":"naver","dateUpdated":"2026-11-03T06:42:16.816Z"},"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-346","description":"CWE-346 Origin Validation Error","type":"CWE"}]}],"affected":[{"vendor":"NAVER","product":"NAVER Whale browser","versions":[{"status":"unaffected","version":"5.39.412.57"}],"defaultStatus":"affected"}],"descriptions":[{"lang":"en","value":"Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.","supportingMedia":[{"type":"text/html","base64":false,"value":"Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment."}]}],"references":[{"url":"https://cve.naver.com/detail/cve-2026-120987.html","tags":["vendor-advisory"]}],"credits":[{"lang":"en","value":"Namhyeong Kim (fivehong)","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}