CVE-2025-62585: 
Homebrew vulnerability analysis and mitigation

A Content Security Policy (CSP) bypass vulnerability has been identified in Whale browser versions prior to 4.33.325.17. This vulnerability, tracked as CVE-2025-62585, was discovered and reported by Mingi Jung. The vulnerability was disclosed on October 16, 2025, and affects the browser's security mechanisms (Naver Corporation).

The vulnerability allows attackers to bypass the Content Security Policy through exploitation of a specific scheme in a dual-tab environment. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The weakness has been classified under CWE-358 (Improperly Implemented Security Check for Standard) (NVD).

The successful exploitation of this vulnerability could allow attackers to bypass Content Security Policy protections, potentially leading to high-severity integrity impacts. The CVSS scoring indicates that while there is no impact on confidentiality or availability, the integrity impact is rated as high (NVD).

Users are advised to upgrade to Whale browser version 4.33.325.17 or later, which contains the fix for this vulnerability (Naver Corporation).