Login Sign Up

CVE-2021-21205

8.1 HIGH

📋 TL;DR

This vulnerability allows attackers to bypass navigation restrictions in Google Chrome on iOS by using a specially crafted HTML page. It affects users running Chrome on iOS versions prior to 90.0.4430.72. The flaw enables unauthorized navigation that could lead to further exploitation.

💻 Affected Systems

Products:
  • Google Chrome
Versions: iOS versions prior to 90.0.4430.72
Operating Systems: iOS
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects Chrome on iOS, not desktop or Android versions. Requires user interaction with a malicious HTML page.

📦 What is this software?

Chrome by Google

Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...

Learn more about Chrome →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could redirect users to malicious sites, potentially leading to phishing, malware installation, or credential theft through social engineering.

🟠

Likely Case

Users could be redirected to unwanted or malicious websites, compromising privacy and potentially exposing sensitive information.

🟢

If Mitigated

With proper controls like updated browsers and security software, the risk is limited to temporary inconvenience from unwanted navigation.

🌐 Internet-Facing: HIGH
🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires user to visit a crafted HTML page. No authentication needed for the navigation bypass itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 90.0.4430.72

Vendor Advisory: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html

Restart Required: Yes

Instructions:

1. Open the App Store on iOS. 2. Tap your profile icon. 3. Scroll to find Chrome updates. 4. Tap 'Update' next to Chrome. 5. Restart Chrome after update completes.

🔧 Temporary Workarounds

Use alternative browser

ios

Temporarily switch to Safari or another browser until Chrome is updated.

Disable JavaScript

ios

Disable JavaScript in Chrome settings to prevent crafted HTML pages from executing malicious navigation.

🧯 If You Can't Patch

  • Implement web filtering to block malicious sites
  • Educate users about not clicking suspicious links

🔍 How to Verify

Check if Vulnerable:

Open Chrome, go to Settings > About Chrome, check if version is below 90.0.4430.72.

Check Version:

Not applicable for iOS - check via Chrome settings menu.

Verify Fix Applied:

After updating, verify Chrome version is 90.0.4430.72 or higher in Settings > About Chrome.

📡 Detection & Monitoring

Log Indicators:

  • Unusual navigation patterns in Chrome logs
  • Multiple redirects to unfamiliar domains

Network Indicators:

  • HTTP redirects to suspicious domains
  • Unusual traffic patterns from Chrome

SIEM Query:

source="chrome" AND (event="navigation" OR event="redirect") AND dest_domain NOT IN [allowed_domains]

📊 Metadata

CVE ID: CVE-2021-21205
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: April 26, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON