Is CVE-2021-30533 actively exploited?

Yes. CVE-2021-30533 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-30533 be exploited remotely?

The attack vector of CVE-2021-30533 has not been classified yet.

What is the CVSS score of CVE-2021-30533?

CVE-2021-30533 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-30533

HIGHCISA KEVIN THE WILD

CVE-2021-30533

Published: June 27, 2022

EPSS:10.53%probability of exploitation in 30 daysPercentile:93.1th

Official Description

Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD Source

CISA KEV Advisory

Google Chromium PopupBlocker Security Bypass Vulnerability

Added to KEV: 2022-06-27Federal patch deadline: 2022-07-18

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

Google Chromium's PopupBlocker has an insufficient policy enforcement vulnerability, allowing attackers to bypass navigation restrictions via a crafted iframe. This high-severity flaw has a significant exploitation probability (EPSS 0.10532), making it a critical issue. This vulnerability is confirmed to be actively exploited by CISA.

Active exploitation of this vulnerability has been observed in the wild. This flaw is remotely exploitable through crafted web content.

Recommended Action

Update all affected web browsers utilizing Chromium, such as Google Chrome, Microsoft Edge, and Opera, to the latest versions. Implement strong content security policies to mitigate iframe-related risks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-30533 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-30533 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.