Actively exploited · Published Jun 7, 2021 · Assigned by Chrome
CVE-2021-30533
Medium 6.5 Exploited
In plain English
A medium-severity incorrect authorization in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on June 27, 2022). The chance it is exploited in the next 30 days is estimated at 16.7% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)16.7%top 3.0% of all CVEs
Exploited in the wildYesCISA KEV since Jun 27, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 18, 2022.
Official description
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | chromium | 91.0.4472.77-r0 | ALPINE-CVE-2021-30533 |
| Alpine:v3.21 | chromium | 91.0.4472.77-r0 | ALPINE-CVE-2021-30533 |
| Alpine:v3.22 | chromium | 91.0.4472.77-r0 | ALPINE-CVE-2021-30533 |
| Alpine:v3.23 | chromium | 91.0.4472.77-r0 | ALPINE-CVE-2021-30533 |
| Alpine:v3.24 | chromium | 91.0.4472.77-r0 | ALPINE-CVE-2021-30533 |
| Alpine:v3.20 | qt5-qtwebengine | 5.15.3_git20210510-r4 | ALPINE-CVE-2021-30533 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.3_git20210510-r4 | ALPINE-CVE-2021-30533 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.3_git20210510-r4 | ALPINE-CVE-2021-30533 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.3_git20210510-r4 | ALPINE-CVE-2021-30533 |
| Debian:12 | chromium | 93.0.4577.82-1 | DEBIAN-CVE-2021-30533 |
| Debian:13 | chromium | 93.0.4577.82-1 | DEBIAN-CVE-2021-30533 |
| Debian:14 | chromium | 93.0.4577.82-1 | DEBIAN-CVE-2021-30533 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html x_refsource_MISC
- https://crbug.com/1145553 x_refsource_MISC
- GLSA-202107-06 vendor-advisory, x_refsource_GENTOO
- FEDORA-2021-f94dadff78 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-ca58c57bdf vendor-advisory, x_refsource_FEDORA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30533 government-resource