CVE-2021-21164: 
vulnerability analysis and mitigation

CVE-2021-21164 is a security vulnerability discovered in Google Chrome for iOS prior to version 89.0.4389.72. The vulnerability stems from insufficient data validation that could allow a remote attacker to leak cross-origin data through a crafted HTML page (NVD, Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-346 (Origin Validation Error) and affects the data validation mechanisms in Chrome's iOS implementation (NVD).

The vulnerability allows an attacker to potentially leak cross-origin data, which could lead to unauthorized access to sensitive information from different origins within the browser context. The attack requires user interaction through a specially crafted HTML page (NVD).

The vulnerability requires user interaction with a crafted HTML page to be exploited. It can be triggered remotely but needs the user to interact with malicious content (NVD).

The vulnerability was patched in Chrome for iOS version 89.0.4389.72. Users are advised to update to this version or later to mitigate the risk. The fix was reported by Muneaki Nishimura (nishimunea) on January 11, 2021 (Chrome Release).