CVE-2018-12448 Security feature bypass in Whale Browser
Whale Browser hides the URL for non-http pages, allowing attackers to spoof domain names and mislead users about the site's identity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12448?
CVE-2018-12448 is a medium-severity vulnerability in NAVER Corporation Whale Browser, published on 2 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
Weakness: CWE-20
Which versions are affected by CVE-2018-12448?
It affects 1 product.
Products include Navercorp Whale.
How do I fix CVE-2018-12448?
No fix has been published for CVE-2018-12448 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-12448 being exploited?
There is no known exploitation of CVE-2018-12448 in the wild and no public exploit code.
Other vulnerabilities in NAVER Corporation Whale Browser
Sources
Also known as GHSA-hj27-g349-7jw4.