CVE-2021-30583
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0...
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
CVE-2021-30583- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
CVE-2021-30583- Updated
- 2026-11-02
EUVDEUVD-2021-17503 No score
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
EUVD-2021-17503- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2jph-pjp9-r9w7
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0...
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
GHSA-2jph-pjp9-r9w7- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-30583
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
ALPINE-CVE-2021-30583- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
CVE-2021-30583- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-30583
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
DEBIAN-CVE-2021-30583- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-30583
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
UBUNTU-CVE-2021-30583- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.14 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.15 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.16 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.17 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.18 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.19 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.20 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.21 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.22 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumAlpine:v3.23 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.24 |
before 92.0.4515.107-r0 | 92.0.4515.107-r0 |
chromiumDebian:12 |
before 93.0.4577.82-1 | 93.0.4577.82-1 |
chromiumDebian:13 |
before 93.0.4577.82-1 | 93.0.4577.82-1 |
chromiumDebian:14 |
before 93.0.4577.82-1 | 93.0.4577.82-1 |
chromium-browserUbuntu:18.04:LTS |
before 92.0.4515.159-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
92.0.4515.159-0ubuntu0.18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-30583 is a medium vulnerability (CVSS 6.5) in Google Chrome, published August 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in chromium 92.0.4515.107-r0.
References
chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html
crbug.com/1179290
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF
nvd.nist.gov/vuln/detail/CVE-2021-30583
Show 8 moreShow less
github.com/advisories/GHSA-2jph-pjp9-r9w7
security.alpinelinux.org/vuln/CVE-2021-30583
security-tracker.debian.org/tracker/CVE-2021-30583
ubuntu.com/security/CVE-2021-30583
cve.org/CVERecord?id=CVE-2021-30583
Left out here: 5 versions. The JSON record has them.