CVE-2021-21171 is a medium-severity vulnerability affecting Google Chrome on Android, Debian, and Fedora Project, allowing a remote attacker to spoof the Omnibox (URL bar) content through a crafted HTML page due to incorrect security UI in TabStrip and Navigation. This attack requires user interaction (UI:R) but has low attack complexity (AC:L) and can lead to high integrity impact (I:H) by deceiving users about the authenticity of a website. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB) and it's not listed in the KEV catalog, the vulnerability has garnered significant community discussion and media coverage, indicating awareness despite the lack of active exploitation intelligence.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 89.0.4389.72CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.