CVE-2022-24072

Name of the Vulnerable Software and Affected Versions Whale browser versions prior to 3.12.129.18

Description The issue concerns the devtools API in the Whale browser, which allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow. This led to extensions downloading and uploading when users opened the developer tool.

Recommendations For Whale browser versions prior to 3.12.129.18, update to version 3.12.129.18 or later to resolve the issue. As a temporary workaround, consider disabling the use of the devtools API until a patch is available.