CVE-2021-30533
Google Chromium PopupBlocker Security Bypass Vulnerability
Description
CVE-2021-30533 is a security bypass vulnerability in the Google Chromium PopupBlocker component that allows a remote attacker to bypass navigation restrictions via a crafted iframe. The insufficient policy enforcement in the popup blocking mechanism enables malicious web pages to display unauthorized popups or navigate users to unintended destinations despite the browser's built-in protections. This vulnerability affects all Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. CISA has added CVE-2021-30533 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 10.5% (93.2nd percentile), this vulnerability shows significantly elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 91.0.4472.77 | |
| fedoraproject | fedora | 33; 34 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html(Release Notes, Vendor Advisory)
- https://crbug.com/1145553(Exploit, Issue Tracking, Patch, Vendor Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/(Mailing List, Release Notes)
- https://security.gentoo.org/glsa/202107-06(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30533(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2021-30533 stems from insufficient policy enforcement in the Chromium PopupBlocker, where the browser fails to properly validate and enforce its navigation restriction policies when processing crafted iframe elements. This allows malicious web pages to bypass the intended security boundary that prevents unauthorized popups and navigations, enabling attackers to redirect users or display deceptive content.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2021-30533 enables attackers to bypass browser popup blocking and navigation restrictions, which are fundamental security mechanisms that protect users from unwanted redirects, phishing pages, and malicious downloads. The vulnerability is remotely exploitable through crafted web content in an iframe, requiring user interaction only in the form of visiting a page that contains the malicious iframe. Because the attack bypasses browser security policies rather than executing code directly, it is primarily used to facilitate social engineering attacks, redirect users to phishing sites, or deliver drive-by download attacks. The impact extends across all Chromium-based browsers, significantly expanding the affected user base. The EPSS score of 10.5% (93.2nd percentile) indicates high exploitation probability, confirming significant threat actor interest in this bypass technique.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-30533 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 27, 2022, with a remediation deadline of July 18, 2022. With an EPSS score of 10.5% (93.2nd percentile), this vulnerability ranks in the top 7% for exploitation probability, indicating widespread use by threat actors. The bypass of popup blocking and navigation restrictions is particularly valuable for distributing malware through drive-by downloads and for conducting phishing campaigns that redirect users through crafted iframes on compromised or malicious websites.
Remediation
- Update all Chromium-based browsers: Apply the latest browser updates that address CVE-2021-30533, ensuring all Chromium-based browsers in the environment are patched, including Chrome, Edge, and Opera.
- Enable automatic browser updates: Configure browser update policies to ensure timely delivery of security patches across all managed endpoints.
- Implement web content filtering: Deploy network-level web filtering to block access to known malicious domains that may leverage this popup blocking bypass for attack delivery.
- Configure Content Security Policy headers: Ensure web applications deployed by your organization use strict Content Security Policy headers, including frame-ancestors directives, to prevent embedding in malicious iframes.
- Educate users about browser security prompts: Train users to recognize and report unexpected browser navigation behavior, popups, or redirects that may indicate exploitation of popup blocking bypasses.
Technical Details
CVE-2021-30533 is an insufficient policy enforcement vulnerability in the Chromium browser engine's PopupBlocker component. The PopupBlocker is responsible for enforcing the browser's policies regarding popup windows and navigation restrictions, preventing malicious websites from opening unauthorized windows or redirecting users without consent. The vulnerability exists in how the PopupBlocker handles navigation requests originating from crafted iframe elements. By constructing a specially designed iframe, an attacker can trigger a navigation that bypasses the PopupBlocker's policy enforcement, allowing the page to open popups or navigate the user to a different URL despite the browser's built-in restrictions. The attack is delivered through web content and affects all Chromium-based browsers that share the vulnerable PopupBlocker implementation.
Frequently Asked Questions
Is CVE-2021-30533 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2021-30533 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 10.5% (93.2nd percentile) indicates high exploitation probability. The vulnerability is used to bypass browser popup blocking for phishing and malware delivery.
What products are affected by CVE-2021-30533?
CVE-2021-30533 affects Google Chromium's PopupBlocker component, impacting all Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. All versions prior to the security fix are vulnerable.
How do I fix CVE-2021-30533?
Update all Chromium-based browsers to the latest available versions that include the PopupBlocker fix. Enable automatic browser updates to ensure timely patching. Implement web content filtering and strict CSP headers as additional defense layers.
How severe is CVE-2021-30533?
CVE-2021-30533 is a significant security bypass with an EPSS score of 10.5% (93.2nd percentile). While it does not directly enable code execution, the bypass of popup blocking and navigation restrictions facilitates phishing campaigns, malware delivery, and social engineering attacks across all Chromium-based browsers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.