CVE-2026-120987
NoneCVSS
—
EPSS
0.1%
Published
Nov 3, 2026
CISA due date
—
The record
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105769 kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure… CWE-346
- CVE-2026-74760 Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from… CWE-346
- CVE-2026-119331 Ladybird is a truly independent web browser. CWE-346
- CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request… CWE-346
- CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the… CWE-346
- CVE-2026-76026 Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a… CWE-346
- CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-346
- CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to… CWE-346