CVE-2021-30540: 
vulnerability analysis and mitigation

CVE-2021-30540 is a security vulnerability discovered in Google Chrome on Android prior to version 91.0.4472.77. The vulnerability involves incorrect security UI implementation in the payments feature that could allow a remote attacker to perform domain spoofing through a crafted HTML page (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with no impact on confidentiality, high impact on integrity, and no impact on availability (NVD).

The vulnerability allows an attacker to perform domain spoofing through crafted HTML pages, which could potentially mislead users during payment transactions. This could lead to users being deceived about the authenticity of payment-related web pages, potentially resulting in financial fraud or theft of payment information (NVD).

The vulnerability has been patched in Google Chrome version 91.0.4472.77 and later. Users are advised to update their Chrome installations to this version or newer. Multiple Linux distributions have also released security updates to address this vulnerability, including Fedora and Gentoo (Gentoo Advisory, Chrome Release).