CVE DatabaseCVE-2021-30533

Updated 2026-06-17한국어 권고문 →

CVE-2021-305336.5/MEDIUMCISA KEVCWE-863CWE-863

Google Chrome PopupBlocker Policy Bypass Vulnerability via Crafted iframe (CVE-2021-30533)

⚡ Jump to Patch

Affected Vendors

google

Affected Components

chrome

Published Date

2021-06-07

CVSS v3.1

6.5

MEDIUM

EPSS (30d)

16.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Chrome prior to version 91.0.4472.77

Impact

Remote attackers can bypass navigation restrictions and popup blocking policies via a crafted iframe, leading to unauthorized redirections

Mitigation

Immediately update Google Chrome to the latest stable version (91.0.4472.77 or higher)

Affected Products & Version Scope

Google Chrome prior to version 91.0.4472.77 on Windows, macOS, and Linux

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

To mitigate this vulnerability, upgrade Google Chrome to the latest stable release. For Linux-based enterprise environments, use the package manager to apply the update.

bash

# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get --only-upgrade install google-chrome-stable -y

# For RedHat/CentOS/Fedora-based systems
sudo dnf upgrade google-chrome-stable -y

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, enforce strict browser policies via enterprise configuration. Create or modify the managed policy file at /etc/opt/chrome/policies/managed/policy.json to block unauthorized popups and restrict iframe behaviors.

json

{
  'DefaultPopupsSetting': 2,
  'PopupsAllowedForUrls':,
  'SandboxLegacyDefaultAllow': false
}

3. Log Audit & IoC Verification Commands

Run the following script on endpoints to verify if the installed Google Chrome version is vulnerable (prior to 91.0.4472.77).

bash

# Check installed Chrome version on Linux
chrome_version=$(google-chrome --version | awk '{print $3}')
required_version='91.0.4472.77'

if [ '$(printf '%s\
' '$required_version' '$chrome_version' | sort -V | head -n1)' != '$required_version' ]; then
  echo '[WARNING] Vulnerable Chrome version detected: '$chrome_version'. Immediate update required.'
else
  echo '[OK] Chrome version is secure: '$chrome_version'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild (CISA KEV), immediately enforce Google Chrome updates to version 91.0.4472.77 or later across all enterprise endpoints.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-30533) exists due to insufficient policy enforcement within the PopupBlocker component of Google Chrome. The browser is designed to restrict unauthorized popups and navigation attempts that lack explicit user interaction. However, a logical flaw (CWE-863) in handling nested subframes (iframes) allows a crafted iframe to bypass these security boundaries, failing to inherit or enforce the parent frame's navigation restrictions properly.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by hosting a malicious webpage containing a specially crafted iframe structure. When a victim visits the page, the malicious script inside the iframe triggers a navigation event. Under normal circumstances, Chrome's PopupBlocker blocks such actions unless triggered by a user gesture. By exploiting this flaw, the attacker bypasses the validation checks, forcing the browser to open unauthorized popups or redirect the active tab to an arbitrary, potentially malicious destination.

3. Infrastructure & Business Impact

As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, it represents a highly practical threat vector actively leveraged by adversaries. In an enterprise environment, successful exploitation can lead to drive-by downloads, credential harvesting via forced phishing redirections, or exposure to malicious ad networks, compromising endpoint security and corporate data integrity.

Official Vendor Advisories & References

NVD Original English Description

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.

https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html

Source: chrome-cve-admin@google.com · Release Notes, Vendor Advisory

https://crbug.com/1145553

Source: chrome-cve-admin@google.com · Exploit, Issue Tracking, Patch, Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/

Source: chrome-cve-admin@google.com · Mailing List, Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/

Source: chrome-cve-admin@google.com · Mailing List, Release Notes

https://security.gentoo.org/glsa/202107-06

Source: chrome-cve-admin@google.com · Third Party Advisory

https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Release Notes, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2021-30533)

FAQ

Q1. How critical is CVE-2021-30533 and is it actively exploited in the wild?

CVE-2021-30533 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 16.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-30533?

Primary impacted vendors include google across chrome. Scope summary: Google Chrome prior to version 91.0.4472.77 on Windows, macOS, and Linux

Q3. What temporary mitigations or workarounds exist for CVE-2021-30533 before patching?

[Mitigation] Immediately update Google Chrome to the latest stable version (91.0.4472.77 or higher) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION