CVE-2022-24074
📋 TL;DR
CVE-2022-24074 is a critical vulnerability in Whale Browser's default Whale Bridge extension that allows compromised rendering processes to send arbitrary messages and gain control of the extension. This affects all Whale Browser users running versions before 3.12.129.18. The vulnerability enables privilege escalation from content scripts to extension control.
💻 Affected Systems
- Whale Browser
📦 What is this software?
Whale by Navercorp
⚠️ Risk & Real-World Impact
Worst Case
Complete browser compromise allowing attackers to execute arbitrary code, steal sensitive data, install malware, and perform actions with the user's privileges.
Likely Case
Attackers exploiting malicious websites could gain control of the Whale Bridge extension to intercept communications, modify browser behavior, and access sensitive information.
If Mitigated
With proper browser sandboxing and extension isolation, impact would be limited to the compromised tab's context.
🎯 Exploit Status
Exploitation requires user to visit malicious website but no authentication needed once user interacts with content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.12.129.18 and later
Vendor Advisory: https://cve.naver.com/detail/cve-2022-24074
Restart Required: Yes
Instructions:
1. Open Whale Browser. 2. Click menu → About Whale. 3. Browser will auto-update if not at latest version. 4. Restart browser when prompted.
🔧 Temporary Workarounds
Disable Whale Bridge via Enterprise Policy
allEnterprise administrators can disable the vulnerable extension via group policy.
Configure ExtensionInstallBlocklist policy to include Whale Bridge extension ID
🧯 If You Can't Patch
- Restrict users from browsing untrusted websites using web filtering or proxy controls.
- Implement application whitelisting to prevent execution of malicious payloads that might result from exploitation.
🔍 How to Verify
Check if Vulnerable:
Check Whale Browser version: Menu → About Whale. If version is below 3.12.129.18, system is vulnerable.Check Version:
On Windows: whale://version/ or check browser About dialogVerify Fix Applied:
Confirm version is 3.12.129.18 or higher in About Whale dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual extension message activity
- Suspicious content script to extension communication
Network Indicators:
- Connections to known malicious domains that could host exploit code
SIEM Query:
Browser logs showing Whale Bridge extension receiving messages from untrusted content scripts