CVE-2021-30533VulnerabilityPublished 06/27/2022Updated 10/24/2026

CVE-2021-30533: Google Chromium PopupBlocker Security Bypass Vulnerability

Affects Google Chromium PopupBlockerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 06/27/2022
KEV deadline: 07/18/2022
EPSS: 16.7% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-30533 (opens in a new tab)

Description

CVE-2021-30533 is a security vulnerability in the Google Chromium PopupBlocker that allows remote attackers to bypass navigation restrictions via a crafted iframe. This flaw affects multiple Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. The vulnerability is due to insufficient policy enforcement in the PopupBlocker component.

Summary

The vulnerability identified as CVE-2021-30533 involves insufficient policy enforcement in the Chromium PopupBlocker, enabling a remote attacker to bypass navigation restrictions by using a specially crafted iframe. This issue impacts various web browsers built on the Chromium engine, including Google Chrome, Microsoft Edge, and Opera. The weakness is categorized under CWE-863 (Incorrect Authorization). Exploits leveraging this vulnerability have been observed in the wild.

Impact

Successful exploitation allows attackers to circumvent navigation restrictions imposed by the PopupBlocker, potentially leading to unwanted popups or navigation actions that users expect to be blocked. This could degrade user experience and may facilitate further attacks relying on forced navigation or popup abuse.

Mitigation

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official Chromium and browser vendor advisories for updates addressing this vulnerability.

Weaknesses

CWE-863Incorrect Authorization (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:05:21 UTC

Weaknesses

References

Related threats