CVE-2021-30682

MEDIUM

tvOS <14.6-iPadOS <14.6-macOS <11.4-watchOS <7.5 - Info Disclosure

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-30682. PoCs published by threatnix.

AI-analyzed exploit summary This PoC demonstrates a CSP bypass vulnerability (CVE-2021-30682) by crafting a form submission to a whitelisted domain while sending CSP violation reports to an attacker-controlled endpoint. The exploit leverages the `form-action` directive to bypass CSP restrictions.

Description

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak sensitive user information.

Exploits (1)

nomisec WORKING POC 9 stars

by threatnix · poc

https://github.com/threatnix/csp-playground

View Code ZIP pw:eip

This PoC demonstrates a CSP bypass vulnerability (CVE-2021-30682) by crafting a form submission to a whitelisted domain while sending CSP violation reports to an attacker-controlled endpoint. The exploit leverages the `form-action` directive to bypass CSP restrictions.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Moderate

Reliability

Reliable

Target: Web browsers with CSP enforcement

No auth needed

Prerequisites: A whitelisted domain in the CSP policy · Victim interaction (clicking the exploit button)

MITRE ATT&CK

T1189 - Drive-by Compromise

mistral-large-3 · analyzed Feb 18, 2026 Full analysis →