NAVER vulnerabilities
We track 10 vulnerabilities in NAVER products across 5 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
Latest NAVER vulnerabilities
- 7.8 High severity
NAVER MYBOX Explorer: Incorrect Privilege Assignment
NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to improper privilege checks.
- 7.7 High severity
NAVER MYBOX Explorer: Incorrect Privilege Assignment
NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to improper privilege checks.
- 7.8 High severity
NAVER MYBOX Explorer: Incorrect Privilege Assignment
NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks.
- 9.8 Critical severity
billboard.js: Improperly Controlled Modification of Object Prototype Attributes
billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.6 Critical severity
NAVER Whale browser: Improper Neutralization of Input During Web Page Generation
Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.
- 7.5 High severity
nGrinder: Missing Authorization
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery.
- 9.8 Critical severity
nGrinder: Deserialization of Untrusted Data
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
- 9.8 Critical severity
nGrinder: Deserialization of Untrusted Data
nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker.
- 9.8 Critical severity
NAVER Whale browser: Exposure of Resource to Wrong Sphere
Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.
- 7.1 High severity
NAVER Whale browser: Incorrect Use of Privileged APIs
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.