Is CVE-2021-30533 (Google Chromium PopupBlocker Security Bypass) being exploited in the wild?

Yes. CISA added CVE-2021-30533 to its Known Exploited Vulnerabilities catalogue on 27 June 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe.

What this answer means for exploitation status

The key point is that this is not a theoretical or low-confidence report. When CISA places a CVE in the Known Exploited Vulnerabilities catalogue, it is signalling that exploitation has been observed with enough confidence to warrant operational action, not just vendor concern or proof-of-concept interest. For practitioners, that changes the question from “is it possible?” to “have we already exposed ourselves to it?”

For CVE tracking, keep the official record view in mind: the CVE Program is the canonical identifier source, while NIST National Vulnerability Database is the place to confirm the record metadata you are using for prioritisation and internal tracking.

How to confirm exposure and scope quickly

Because the issue affects Google Chromium PopupBlocker through a navigation restriction bypass, your first task is to identify every Chromium-based browser surface in scope, including managed desktop browsers, embedded browser components, and any products that package Chromium but do not advertise that clearly. In practice, teams often miss shadow installations, alternate channels, and user-installed copies that sit outside central patch inventory.

If your environment relies on browser policy to prevent risky navigation or iframe-driven redirects, inspect whether the control is enforced consistently across the fleet and whether exceptions exist for particular user groups, profiles, or kiosks. The relevant distinction is not whether Chromium is installed somewhere, but whether an exploitable browser path can still reach sensitive internal apps, admin consoles, or authentication flows.

For a broader browser hardening checklist, NHIMG’s Enterprise Browser and Browser Security Guide is useful when you need to think about policy enforcement, extension control, and browser telemetry as one control surface rather than isolated settings.

What to do when patching must wait

If you cannot remediate immediately, use compensating controls that reduce the chance that a crafted iframe can be used as a practical bypass path. That usually means tightening browser policy where possible, limiting access to sensitive workflows from unmanaged or exception-prone browsers, and reducing the number of places where a browser-session compromise could matter. Temporary exceptions should be explicit, time-bound, and visible to the teams that own the exposed workflow.

Because the issue is classed as actively exploited, delay should trigger a risk decision rather than a generic backlog entry. The more valuable the browser path is for login, admin access, or internal portals, the more important it is to treat containment as an interim control, not a substitute for patching. For organisations that already prioritise exploited vulnerabilities, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is the right operational lens, and the CISA Known Exploited Vulnerabilities Catalog is the authoritative source for the required remediation posture.

Risk and Threat Considerations

Browser policy bypasses are dangerous because they can turn a “trusted” client control into a false assurance. If the browser is allowed to reach high-value web properties, a remote attacker does not need full device compromise to create meaningful impact, they only need a path that defeats the navigation restriction the organisation believed was protecting users.

Failure mechanism: A crafted iframe or similar browser construct can bypass intended policy enforcement, allowing navigation that should have been blocked and creating access to unexpected destinations or attack chains.

Impact: Users may be steered into credential capture, malicious redirects, or secondary exploitation paths that were assumed to be unavailable, which can widen the blast radius of a browser weakness beyond the browser itself.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid identification and remediation prioritisation.
Recommendation — Prioritise and remediate the vulnerable browser fleet using continuous vulnerability management.
NIST CSF 2.0	ID.RA-01 — Vulnerability identification and analysis	The question is about confirming exploit status and exposure from a known vulnerability.
	PR.PS-02 — Software is maintained, replaced, and removed as required	Remediation depends on getting affected browser software updated or replaced promptly.
	DE.CM-01 — Networks and network services are monitored to find potentially adverse events	Browser exploitation often needs monitoring for suspicious navigation and follow-on activity.
Recommendation — Analyze the CVE’s exploit status and exposure across the browser estate. Update or replace affected Chromium-based browsers to remove the vulnerable software. Monitor browser and web activity for signs of exploitation or unusual redirects.

Practitioner Guidance

What to verify: Confirm whether the vulnerable browser version is present in any managed or unmanaged channel, and whether the affected policy is actually relied upon to protect sensitive workflows. If the answer is yes, treat exposure as real even if you have not seen abuse yet.

Decision rule: If browser policy is part of your security boundary, prioritise rapid update and exposure assessment before you spend time proving whether the flaw has already been abused. If the browser only reaches low-risk, non-sensitive destinations, the urgency is lower, but it should still stay on the active remediation list.

Practitioner takeaway: For exploited browser flaws, the operational question is not whether the issue is “just a browser bug”, it is whether a control you depended on to shape user navigation can still be bypassed in a way that changes your real exposure.