⚠ Actively exploited
Added to CISA KEV on 2022-06-27. Federal agencies required to patch by 2022-07-18. Required action: Apply updates per vendor instructions..

CVE-2021-30533 — Incorrect Authorization in Google Chrome

CWE-863 — Incorrect Authorization8 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
10.5%
top 6.71%
CISA KEV
KEV
Added 2022-06-27
Due 2022-07-18
Exploit
Exploited in wild
Active exploitation observed
Affected products
6
Google ChromeChromiumDebian Chromium+3 more
Timeline
PublishedJun 7
KEV addedJun 27
KEV dueJul 18
CISA Required Action: Apply updates per vendor instructions.

Description

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5google/chromeunspecified — 91.0.4472.77
▶NVDgoogle/chrome< 91.0.4472.77
▶debiandebian/chromium< chromium 93.0.4577.82-1 (bookworm)
▶Debianchromium/chromium< 93.0.4577.82-1+3

Also affects: Fedora 33, 34

Patches

Patch: crbug.com ↗Patch: crbug.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-83cg-29pr-h246: Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91↗2022-05-24
▶
OSV
CVE-2021-30533: Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91↗2021-06-07
▶
VulnCheck
Google Chromium PopupBlocker Security Bypass Vulnerability↗2021
▶

📋Vendor Advisories

4
CISA
Google Chromium PopupBlocker Security Bypass Vulnerability↗2022-06-27
▶
Chrome
Stable Channel Update for Desktop: CVE-2021-30532↗2021-05-25
▶
Microsoft
Chromium: CVE-2021-30533 Insufficient policy enforcement in PopupBlocker↗2021-05-11
▶
Debian
CVE-2021-30533: chromium - Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4...↗2021
▶