CVE-2021-21208
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed...
6.5 MediumFix available
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
1.40%Up 0.8 points since Apr 27, 2021
What each source reports
NVD Score used
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
CVE-2021-21208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
CVE-2021-21208- Updated
- 2026-11-02
EUVDEUVD-2021-8599 No score
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
EUVD-2021-8599- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h7gw-jv92-h37j No score
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed...
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
GHSA-h7gw-jv92-h37j- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-21208
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
ALPINE-CVE-2021-21208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
CVE-2021-21208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-21208
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
DEBIAN-CVE-2021-21208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-21208
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
- Record
UBUNTU-CVE-2021-21208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0629-1 No score
Security update for Chromium
This update for chromium fixes the following issues:
- Chromium was updated to 90.0.4430.93 (boo#1184764,boo#1185047,boo#1185398)
- CVE-2021-21227: Insufficient data validation in V8.
- CVE-2021-21232: Use after free in Dev Tools.
- CVE-2021-21233: Heap buffer overflow in ANGLE.
- CVE-2021-21228: Insufficient policy enforcement in extensions.
- CVE-2021-21229: Incorrect security UI in downloads.
- CVE-2021-21230: Type Confusion in V8.
- CVE-2021-21231: Insufficient data validation in V8.
- CVE-2021-21222: Heap buffer overflow in V8
- CVE-2021-21223: Integer overflow in Mojo
- CVE-2021-21224: Type Confusion in V8
- CVE-2021-21225: Out of bounds memory access in V8
- CVE-2021-21226: Use after free in navigation
- CVE-2021-21201: Use after free in permissions
- CVE-2021-21202: Use after free in extensions
- CVE-2021-21203: Use after free in Blink
- CVE-2021-21204: Use after free in Blink
- CVE-2021-21205: Insufficient policy enforcement in navigation
- CVE-2021-21221: Insufficient validation of untrusted input in Mojo
- CVE-2021-21207: Use after free in IndexedDB
- CVE-2021-21208: Insufficient data validation in QR scanner
- CVE-2021-21209: Inappropriate implementation in storage
- CVE-2021-21210: Inappropriate implementation in Network
- CVE-2021-21211: Inappropriate implementation in Navigatio
- CVE-2021-21212: Incorrect security UI in Network Config UI
- CVE-2021-21213: Use after free in WebMIDI
- Record
openSUSE-SU-2021:0629-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.14 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.15 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.16 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.17 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.18 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.19 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.20 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.21 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.22 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumAlpine:v3.23 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.24 |
before 90.0.4430.72-r0 | 90.0.4430.72-r0 |
chromiumDebian:12 |
before 90.0.4430.72-1 | 90.0.4430.72-1 |
chromiumDebian:13 |
before 90.0.4430.72-1 | 90.0.4430.72-1 |
chromiumDebian:14 |
before 90.0.4430.72-1 | 90.0.4430.72-1 |
chromiumDebian:10 From an advisory covering 25 CVEs |
before 90.0.4430.85-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 45 moreShow less76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-280.0.3987.132-180.0.3987.132-1~deb10u180.0.3987.149-180.0.3987.149-1~deb10u180.0.3987.162-180.0.3987.162-1~deb10u181.0.4044.62-181.0.4044.92-183.0.4103.106-183.0.4103.116-183.0.4103.116-1~deb10u183.0.4103.116-1~deb10u283.0.4103.116-1~deb10u383.0.4103.116-283.0.4103.116-383.0.4103.116-3.183.0.4103.83-184.0.4147.105-184.0.4147.89-187.0.4280.141-0.187.0.4280.141-0.1~deb10u187.0.4280.88-0.187.0.4280.88-0.287.0.4280.88-0.387.0.4280.88-0.4 |
90.0.4430.85-1~deb10u1 |
chromium-browserUbuntu:16.04:LTS |
before 90.0.4430.72-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1 |
90.0.4430.72-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS |
before 90.0.4430.72-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
90.0.4430.72-0ubuntu0.18.04.1 |
chromiumopenSUSE:Leap 15.2 From an advisory covering 25 CVEs |
before 90.0.4430.93-lp152.2.89.1 | 90.0.4430.93-lp152.2.89.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21208 is a medium vulnerability (CVSS 6.5) in Google Chrome, published April 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in chromium 90.0.4430.72-r0.
References
chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
crbug.com/1039539
debian.org/security/2021/dsa-4906
security.gentoo.org/glsa/202104-08
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-21208
github.com/advisories/GHSA-h7gw-jv92-h37j
security.alpinelinux.org/vuln/CVE-2021-21208
security-tracker.debian.org/tracker/CVE-2021-21208
ubuntu.com/security/CVE-2021-21208
cve.org/CVERecord?id=CVE-2021-21208
lists.opensuse.org/archives/list/[email protected]/thread/NBOWNTMQCMDYBSMTERFTO5ZSZSUCY7QW
bugzilla.suse.com/11845047
suse.com/security/cve/CVE-2021-21201
This page doesn't list everything
Left out here: 36 versions and 2,130 references. The JSON record has them.