Vulnerability Details : CVE-2021-30589
Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a crafted click-to-call link.
Vulnerability category: Input validation
Exploit prediction scoring system (EPSS) score for CVE-2021-30589
Probability of exploitation activity in the next 30 days: 0.24%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 63 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-30589
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2021-30589
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-30589
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QW4R2K5HVJ4R6XDZYOJCCFPIN2XHNS3L/
[SECURITY] Fedora 34 Update: chromium-93.0.4577.63-1.fc34 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://crbug.com/1180510
1180510 - security: click-to-call across devices has inconsistent escaping & URL validation - chromiumIssue Tracking;Patch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
[SECURITY] Fedora 35 Update: chromium-93.0.4577.63-1.fc35 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html
Chrome Releases: Stable Channel Update for DesktopVendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
[SECURITY] Fedora 33 Update: chromium-93.0.4577.63-1.fc33 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Products affected by CVE-2021-30589
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*