CVE-2022-24073
📋 TL;DR
A vulnerability in Whale browser's Web Request API allowed malicious extensions to block access to the extension store or redirect users to arbitrary URLs when attempting to visit the store. This affects Whale browser users with vulnerable extensions installed before version 3.12.129.18.
💻 Affected Systems
- Whale browser
📦 What is this software?
Whale by Navercorp
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to phishing sites or malware distribution pages when trying to access the legitimate extension store, leading to credential theft or system compromise.
Likely Case
Users experience disruption accessing the extension store or are redirected to unwanted advertising pages.
If Mitigated
With updated browser and careful extension management, impact is limited to temporary inconvenience.
🎯 Exploit Status
Exploitation requires user to install a malicious extension first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.12.129.18 and later
Vendor Advisory: https://cve.naver.com/detail/cve-2022-24073
Restart Required: Yes
Instructions:
1. Open Whale browser. 2. Click menu (three dots) → Help → About Whale. 3. Browser will automatically check for and install updates. 4. Restart browser when prompted.
🔧 Temporary Workarounds
Disable suspicious extensions
allRemove or disable extensions that are not from trusted sources
Open Whale browser → Menu → More tools → Extensions → Toggle off or remove suspicious extensions
🧯 If You Can't Patch
- Use alternative browsers for accessing extension stores
- Implement network filtering to block redirects to unknown domains
🔍 How to Verify
Check if Vulnerable:
Check browser version in menu → Help → About Whale. If version is below 3.12.129.18, system is vulnerable.Check Version:
whale://version/ (in browser address bar)Verify Fix Applied:
Confirm browser version is 3.12.129.18 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unexpected redirects from store.whale.naver.com to external domains
- Extension installation/update failures
Network Indicators:
- HTTP 302 redirects from extension store to suspicious domains
- DNS queries to unexpected domains after accessing store
SIEM Query:
url:store.whale.naver.com AND (status_code:302 OR dest_ip:[external_suspicious_ips])