cyfenced.com →

[ CVE-2021-30533 · Published 7 Jun 2021 ]

Google Chromium PopupBlocker Security Bypass Vulnerability

Exploited · CISA KEV CVSS 6.5 EPSS 17%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-27
  • EPSS: 17% chance of exploitation in the next 30 days (higher than 97% of CVEs)

[ Description ]Official description

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.

CISA: Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Jul 2022): Apply updates per vendor instructions.

[ References ]References