Every CVE Search/ Get API key

CVE-2021-21189

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a...

4.3 MediumFix available

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.46%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.3

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
CVE-2021-21189
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
CVE-2021-21189
Updated
2026-11-02
EUVDEUVD-2021-8580 No score

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
EUVD-2021-8580
Updated
2026-11-03
GitHub AdvisoriesGHSA-ch97-xxm2-3rc8 4.3

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a...

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
GHSA-ch97-xxm2-3rc8
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
OSVALPINE-CVE-2021-21189 4.3

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
ALPINE-CVE-2021-21189
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-03
OSV 4.3

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
CVE-2021-21189
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2021-21189 4.3

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
DEBIAN-CVE-2021-21189
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21189 4.3

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Record
UBUNTU-CVE-2021-21189
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVMGASA-2021-0142 No score

Updated chromium-browser-stable packages fix security vulnerability

The updated packages fix security vulnerabilities. At least one of them is known to be actively exploited.

Record
MGASA-2021-0142
Updated
2026-11-02
OSVopenSUSE-SU-2021:0392-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Update to 89.0.4389.72 (boo#1182358, boo#1182960):

  • CVE-2021-21159: Heap buffer overflow in TabStrip.
  • CVE-2021-21160: Heap buffer overflow in WebAudio.
  • CVE-2021-21161: Heap buffer overflow in TabStrip.
  • CVE-2021-21162: Use after free in WebRTC.
  • CVE-2021-21163: Insufficient data validation in Reader Mode.
  • CVE-2021-21164: Insufficient data validation in Chrome for iOS.
  • CVE-2021-21165: Object lifecycle issue in audio.
  • CVE-2021-21166: Object lifecycle issue in audio.
  • CVE-2021-21167: Use after free in bookmarks.
  • CVE-2021-21168: Insufficient policy enforcement in appcache.
  • CVE-2021-21169: Out of bounds memory access in V8.
  • CVE-2021-21170: Incorrect security UI in Loader.
  • CVE-2021-21171: Incorrect security UI in TabStrip and Navigation.
  • CVE-2021-21172: Insufficient policy enforcement in File System API.
  • CVE-2021-21173: Side-channel information leakage in Network Internals.
  • CVE-2021-21174: Inappropriate implementation in Referrer.
  • CVE-2021-21175: Inappropriate implementation in Site isolation.
  • CVE-2021-21176: Inappropriate implementation in full screen mode.
  • CVE-2021-21177: Insufficient policy enforcement in Autofill.
  • CVE-2021-21178: Inappropriate implementation in Compositing.
  • CVE-2021-21179: Use after free in Network Internals.
  • CVE-2021-21180: Use after free in tab search.
  • CVE-2020-27844: Heap buffer overflow in OpenJPEG.
  • CVE-2021-21181: Side-channel information leakage in autofill.
  • CVE-2021-21182: Insufficient policy enforcement in navigations.
  • CVE-2021-21183: Inappropriate implementation in performance APIs.
  • CVE-2021-21184: Inappropriate implementation in performance APIs.
  • CVE-2021-21185: Insufficient policy enforcement in extensions.
  • CVE-2021-21186: Insufficient policy enforcement in QR scanning.
  • CVE-2021-21187: Insufficient data validation in URL formatting.
  • CVE-2021-21188: Use after free in Blink.
  • CVE-2021-21189: Insufficient policy enforcement in payments.
  • CVE-2021-21190: Uninitialized Use in PDFium.
  • CVE-2021-21149: Stack overflow in Data Transfer.
  • CVE-2021-21150: Use after free in Downloads.
  • CVE-2021-21151: Use after free in Payments.
  • CVE-2021-21152: Heap buffer overflow in Media.
  • CVE-2021-21153: Stack overflow in GPU Process.
  • CVE-2021-21154: Heap buffer overflow in Tab Strip.
  • CVE-2021-21155: Heap buffer overflow in Tab Strip.
  • CVE-2021-21156: Heap buffer overflow in V8.
  • CVE-2021-21157: Use after free in Web Sockets.
  • Fixed Sandbox with glibc 2.33 (boo#1182233)
  • Fixed an issue where chromium hangs on opening (boo#1182775).
Record
openSUSE-SU-2021:0392-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0401-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Update to 89.0.4389.72 (boo#1182358, boo#1182960):

  • CVE-2021-21159: Heap buffer overflow in TabStrip.
  • CVE-2021-21160: Heap buffer overflow in WebAudio.
  • CVE-2021-21161: Heap buffer overflow in TabStrip.
  • CVE-2021-21162: Use after free in WebRTC.
  • CVE-2021-21163: Insufficient data validation in Reader Mode.
  • CVE-2021-21164: Insufficient data validation in Chrome for iOS.
  • CVE-2021-21165: Object lifecycle issue in audio.
  • CVE-2021-21166: Object lifecycle issue in audio.
  • CVE-2021-21167: Use after free in bookmarks.
  • CVE-2021-21168: Insufficient policy enforcement in appcache.
  • CVE-2021-21169: Out of bounds memory access in V8.
  • CVE-2021-21170: Incorrect security UI in Loader.
  • CVE-2021-21171: Incorrect security UI in TabStrip and Navigation.
  • CVE-2021-21172: Insufficient policy enforcement in File System API.
  • CVE-2021-21173: Side-channel information leakage in Network Internals.
  • CVE-2021-21174: Inappropriate implementation in Referrer.
  • CVE-2021-21175: Inappropriate implementation in Site isolation.
  • CVE-2021-21176: Inappropriate implementation in full screen mode.
  • CVE-2021-21177: Insufficient policy enforcement in Autofill.
  • CVE-2021-21178: Inappropriate implementation in Compositing.
  • CVE-2021-21179: Use after free in Network Internals.
  • CVE-2021-21180: Use after free in tab search.
  • CVE-2020-27844: Heap buffer overflow in OpenJPEG.
  • CVE-2021-21181: Side-channel information leakage in autofill.
  • CVE-2021-21182: Insufficient policy enforcement in navigations.
  • CVE-2021-21183: Inappropriate implementation in performance APIs.
  • CVE-2021-21184: Inappropriate implementation in performance APIs.
  • CVE-2021-21185: Insufficient policy enforcement in extensions.
  • CVE-2021-21186: Insufficient policy enforcement in QR scanning.
  • CVE-2021-21187: Insufficient data validation in URL formatting.
  • CVE-2021-21188: Use after free in Blink.
  • CVE-2021-21189: Insufficient policy enforcement in payments.
  • CVE-2021-21190: Uninitialized Use in PDFium.
  • CVE-2021-21149: Stack overflow in Data Transfer.
  • CVE-2021-21150: Use after free in Downloads.
  • CVE-2021-21151: Use after free in Payments.
  • CVE-2021-21152: Heap buffer overflow in Media.
  • CVE-2021-21153: Stack overflow in GPU Process.
  • CVE-2021-21154: Heap buffer overflow in Tab Strip.
  • CVE-2021-21155: Heap buffer overflow in Tab Strip.
  • CVE-2021-21156: Heap buffer overflow in V8.
  • CVE-2021-21157: Use after free in Web Sockets.
  • Fixed Sandbox with glibc 2.33 (boo#1182233)
  • Fixed an issue where chromium hangs on opening (boo#1182775).

This update was imported from the openSUSE:Leap:15.2:Update update project.

Record
openSUSE-SU-2021:0401-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score

chromedriver-93.0.4577.82-1.1 on GA media

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10681-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Alpine:v3.14
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.15
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.16
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.17
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.18
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.19
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.20
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.21
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.22
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.23
 before 89.0.4389.72-r0
89.0.4389.72-r0
Show 13 moreShow less
Affected packages
PackageAffectedFixed
chromium
Alpine:v3.24
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Debian:12
 before 89.0.4389.82-1
89.0.4389.82-1
chromium
Debian:13
 before 89.0.4389.82-1
89.0.4389.82-1
chromium
Debian:14
 before 89.0.4389.82-1
89.0.4389.82-1
chromium
Debian:10
 before 89.0.4389.114-1~deb10u1, plus listed versions
73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1
Show 45 moreShow less
76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-280.0.3987.132-180.0.3987.132-1~deb10u180.0.3987.149-180.0.3987.149-1~deb10u180.0.3987.162-180.0.3987.162-1~deb10u181.0.4044.62-181.0.4044.92-183.0.4103.106-183.0.4103.116-183.0.4103.116-1~deb10u183.0.4103.116-1~deb10u283.0.4103.116-1~deb10u383.0.4103.116-283.0.4103.116-383.0.4103.116-3.183.0.4103.83-184.0.4147.105-184.0.4147.89-187.0.4280.141-0.187.0.4280.141-0.1~deb10u187.0.4280.88-0.187.0.4280.88-0.287.0.4280.88-0.387.0.4280.88-0.4
89.0.4389.114-1~deb10u1
chromium-browser-stable
Mageia:7
 before 89.0.4389.90-1.mga7
89.0.4389.90-1.mga7
chromium-browser-stable
Mageia:8
 before 89.0.4389.90-1.mga8
89.0.4389.90-1.mga8
chromium-browser
Ubuntu:16.04:LTS
 before 89.0.4389.82-0ubuntu0.16.04.1, plus listed versions
45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229
Show 45 moreShow less
49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1
89.0.4389.82-0ubuntu0.16.04.1
chromium-browser
Ubuntu:18.04:LTS
 before 89.0.4389.82-0ubuntu0.18.04.1, plus listed versions
61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1
Show 44 moreShow less
63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.1
89.0.4389.82-0ubuntu0.18.04.1
chromium
openSUSE:Leap 15.2
 before 89.0.4389.72-lp152.2.77.1
89.0.4389.72-lp152.2.77.1
chromium
SUSE:Package Hub 15 SP2
 before 89.0.4389.72-bp152.2.62.1
89.0.4389.72-bp152.2.62.1
chromium
openSUSE:Tumbleweed
 before 93.0.4577.82-1.1
93.0.4577.82-1.1
chromium
openSUSE:Tumbleweed
 before 113.0.5672.92-1.1
113.0.5672.92-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21189 is a medium vulnerability (CVSS 4.3) in Google Chrome, published March 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in chromium 89.0.4389.72-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 30 versions and 2,135 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open