NAVER vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-8148 NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to impropHigh 7.8 · May 8, 2026
• CVE-2025-69235 Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.High 7.5 · Dec 29, 2025
• CVE-2025-69234 Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.Critical 9.1 · Dec 29, 2025
• CVE-2025-62585 Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.High 7.5 · Oct 16, 2025
• CVE-2025-62584 Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.High 7.5 · Oct 16, 2025
• CVE-2025-62583 Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.Critical 9.8 · Oct 16, 2025
• CVE-2025-58323 NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to imprHigh 7.7 · Aug 28, 2025
• CVE-2025-58322 NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to impropHigh 7.8 · Aug 28, 2025
• CVE-2025-53600 Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.High 7.5 · Jul 4, 2025
• CVE-2025-53599 Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.Critical 9.8 · Jul 4, 2025
• CVE-2025-49223 billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cCritical 9.8 · Jun 3, 2025
• CVE-2024-40618 Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.Critical 9.6 · Jul 10, 2024
• CVE-2024-28215 nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information discloHigh 7.5 · Mar 7, 2024
• CVE-2024-28213 nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafCritical 9.8 · Mar 7, 2024
• CVE-2024-28212 nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.Critical 9.8 · Mar 7, 2024
• CVE-2024-28211 nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote Critical 9.8 · Mar 7, 2024
• CVE-2022-24077 Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.High 7.8 · Jun 13, 2022
• CVE-2022-24074 Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could leadCritical 9.8 · Mar 17, 2022
• CVE-2022-24073 The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.High 7.1 · Mar 17, 2022
• CVE-2021-33592 NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file.Critical 9.8 · Jul 19, 2021
• CVE-2021-33591 An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.High 8.8 · May 28, 2021
• CVE-2020-9753 Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.Critical 9.1 · May 19, 2020
• CVE-2020-9752 Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe.Critical 9.8 · Mar 22, 2020
• CVE-2020-9751 Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade.Critical 9.1 · Mar 3, 2020
• CVE-2019-13157 nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.High 7.5 · Nov 21, 2019