CVE-2021-21205
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72...
8.1 HighFix available
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
1.47%Up 0.7 points since Apr 27, 2021
What each source reports
NVD Score used
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
CVE-2021-21205- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
CVE-2021-21205- Updated
- 2026-11-02
EUVDEUVD-2021-8596 No score
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
EUVD-2021-8596- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2j9-899j-2whm No score
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72...
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
GHSA-x2j9-899j-2whm- Updated
- 2026-11-02
OSVALPINE-CVE-2021-21205
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
ALPINE-CVE-2021-21205- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
OSV
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
CVE-2021-21205- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-21205
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
DEBIAN-CVE-2021-21205- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-21205
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- Record
UBUNTU-CVE-2021-21205- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0629-1 No score
Security update for Chromium
This update for chromium fixes the following issues:
- Chromium was updated to 90.0.4430.93 (boo#1184764,boo#1185047,boo#1185398)
- CVE-2021-21227: Insufficient data validation in V8.
- CVE-2021-21232: Use after free in Dev Tools.
- CVE-2021-21233: Heap buffer overflow in ANGLE.
- CVE-2021-21228: Insufficient policy enforcement in extensions.
- CVE-2021-21229: Incorrect security UI in downloads.
- CVE-2021-21230: Type Confusion in V8.
- CVE-2021-21231: Insufficient data validation in V8.
- CVE-2021-21222: Heap buffer overflow in V8
- CVE-2021-21223: Integer overflow in Mojo
- CVE-2021-21224: Type Confusion in V8
- CVE-2021-21225: Out of bounds memory access in V8
- CVE-2021-21226: Use after free in navigation
- CVE-2021-21201: Use after free in permissions
- CVE-2021-21202: Use after free in extensions
- CVE-2021-21203: Use after free in Blink
- CVE-2021-21204: Use after free in Blink
- CVE-2021-21205: Insufficient policy enforcement in navigation
- CVE-2021-21221: Insufficient validation of untrusted input in Mojo
- CVE-2021-21207: Use after free in IndexedDB
- CVE-2021-21208: Insufficient data validation in QR scanner
- CVE-2021-21209: Inappropriate implementation in storage
- CVE-2021-21210: Inappropriate implementation in Network
- CVE-2021-21211: Inappropriate implementation in Navigatio
- CVE-2021-21212: Incorrect security UI in Network Config UI
- CVE-2021-21213: Use after free in WebMIDI
- Record
openSUSE-SU-2021:0629-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.14 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.15 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.16 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.17 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.18 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.19 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.20 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.21 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.22 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.23 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.24 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumDebian:12 |
before 90.0.4430.72-1 | 90.0.4430.72-1 |
chromiumDebian:13 |
before 90.0.4430.72-1 | 90.0.4430.72-1 |
chromiumDebian:14 |
before 90.0.4430.72-1 | 90.0.4430.72-1 |
chromiumDebian:10 From an advisory covering 25 CVEs |
before 90.0.4430.85-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 45 moreShow less76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-280.0.3987.132-180.0.3987.132-1~deb10u180.0.3987.149-180.0.3987.149-1~deb10u180.0.3987.162-180.0.3987.162-1~deb10u181.0.4044.62-181.0.4044.92-183.0.4103.106-183.0.4103.116-183.0.4103.116-1~deb10u183.0.4103.116-1~deb10u283.0.4103.116-1~deb10u383.0.4103.116-283.0.4103.116-383.0.4103.116-3.183.0.4103.83-184.0.4147.105-184.0.4147.89-187.0.4280.141-0.187.0.4280.141-0.1~deb10u187.0.4280.88-0.187.0.4280.88-0.287.0.4280.88-0.387.0.4280.88-0.4 |
90.0.4430.85-1~deb10u1 |
chromium-browserUbuntu:16.04:LTS |
before 90.0.4430.72-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1 |
90.0.4430.72-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS |
before 90.0.4430.72-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
90.0.4430.72-0ubuntu0.18.04.1 |
chromiumopenSUSE:Leap 15.2 From an advisory covering 25 CVEs |
before 90.0.4430.93-lp152.2.89.1 | 90.0.4430.93-lp152.2.89.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21205 is a high vulnerability (CVSS 8.1) in Google Chrome, published April 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in chromium 90.0.4430.72-r0.
References
chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
crbug.com/1165654
debian.org/security/2021/dsa-4906
security.gentoo.org/glsa/202104-08
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-21205
github.com/advisories/GHSA-x2j9-899j-2whm
security.alpinelinux.org/vuln/CVE-2021-21205
security-tracker.debian.org/tracker/CVE-2021-21205
ubuntu.com/security/CVE-2021-21205
cve.org/CVERecord?id=CVE-2021-21205
lists.opensuse.org/archives/list/[email protected]/thread/NBOWNTMQCMDYBSMTERFTO5ZSZSUCY7QW
bugzilla.suse.com/11845047
suse.com/security/cve/CVE-2021-21201
This page doesn't list everything
Left out here: 36 versions and 2,130 references. The JSON record has them.