CVE-2022-24072: 
Homebrew vulnerability analysis and mitigation

The devtools API in Whale browser before version 3.12.129.18 contained a security vulnerability identified as CVE-2022-24072. This vulnerability allowed extension developers to inject arbitrary JavaScript into the extension store web page through devtools.inspectedWindow. The issue was disclosed on March 17, 2022 (NAVER Advisory).

The vulnerability exists in the devtools API implementation of the Whale browser. It specifically affects the devtools.inspectedWindow interface, which could be exploited to inject arbitrary JavaScript code into the extension store web page. The vulnerability has a CVSS v3 Base Score of 7.8 (High), with attack vector being Network, requiring low privileges and no user interaction (AttackerKB).

When exploited, this vulnerability could lead to unauthorized extensions downloading and uploading when users open the developer tool. This could potentially allow malicious actors to manipulate the extension store functionality and compromise browser security (NAVER Advisory).

The vulnerability has been patched in Whale browser version 3.12.129.18. Users should upgrade to this version or later to mitigate the risk (NAVER Advisory).