CVE-2021-30589: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2021-30589 is a medium (CVSS 4.3) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.5% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 03-08-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a crafted click-to-call link.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.52% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- chromium< 92.0.4515.107-r0
Debian1 product
- chromium< 93.0.4577.82-1
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Google1 product
- chrome≥ unspecified, < 92.0.4515.107 | < 92.0.4515.107
Ubuntu1 product
- chromium-browser< 92.0.4515.159-0ubuntu0.18.04.1
5 vendors · 5 products
References
9 links- chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.htmlX Refsource MISCVendor Advisory
