Vulnerability record · CVE-2021-30533 · published 7 June 2021
CVE-2021-30533: Chrome PopupBlocker policy bypass via crafted iframe
Google · Chrome
Google Chrome before 91.0.4472.77 fails to enforce PopupBlocker policy correctly, letting a crafted iframe bypass navigation restrictions. The flaw is an incorrect authorization issue (CWE-863) that undermines a browser security control meant to constrain navigation. It matters because the bypass is remotely reachable and was later added to CISA's Known Exploited Vulnerabilities catalog.
Description
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Automated analysis
high priorityThe flaw is remotely reachable, requires only user interaction, and is listed in CISA KEV with an elevated EPSS score, though its CVSS severity is medium and impact is limited to integrity.
What it is
Google Chrome before 91.0.4472.77 fails to enforce PopupBlocker policy correctly, letting a crafted iframe bypass navigation restrictions. The flaw is an incorrect authorization issue (CWE-863) that undermines a browser security control meant to constrain navigation. It matters because the bypass is remotely reachable and was later added to CISA's Known Exploited Vulnerabilities catalog.
Impact
An attacker can bypass navigation restrictions enforced by the PopupBlocker, enabling navigation or popup behavior the browser is supposed to block. The CVSS vector shows no confidentiality or availability impact, only high integrity impact.
Attack surface
Reached over the network through a crafted iframe rendered in Chrome; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed, but the victim must load the malicious content.
Exploitation
CVE-2021-30533 is listed in CISA KEV with a 2022-06-27 addition date, and the crbug.com reference is tagged Exploit, indicating known exploitation. EPSS 30-day probability is 0.16611 (96.8th percentile), showing elevated predicted activity.
What to do
- Update Chrome to 91.0.4472.77 or later per the Chrome release notes.
- Apply the corresponding Fedora and Gentoo package updates referenced in the advisories.
- Track KEV remediation deadlines and confirm all browser endpoints meet the required version.
- Where immediate patching is not possible, restrict browsing to trusted sites and reduce exposure to untrusted iframes.
- Verify update compliance across managed endpoints and browser auto-update channels.
Detection
- Monitor for Chrome versions below 91.0.4472.77 in asset and patch inventories.
- Hunt proxy or DNS logs for iframe-heavy or suspicious navigation patterns originating from untrusted sites.
- Review browser crash or renderer telemetry for PopupBlocker-related anomalies around navigation events.
- Correlate endpoint browser version data with KEV due dates to flag unpatched hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-30533 to the Known Exploited Vulnerabilities catalog on 27 June 2022 as "Google Chromium PopupBlocker Security Bypass Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 18 July 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-30533 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-30533), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
