Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.