Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.