How severe is CVE-2021-33596?

CVE-2021-33596 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2021-33596 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-33596?

CVE-2021-33596 affects F-secure Safe. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-33596?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-33596 published?

CVE-2021-33596 was published on 2021-08-05 and last updated on 2026-06-17.

CVE-2021-33596

CVE-2021-33596 is a low-severity vulnerability in F-secure Safe with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1021.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
CVSS v2: 3.5
EPSS exploit prediction: 1% (52nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1021
Affected product: F-secure Safe
Published: 2021-08-05
Last modified: 2026-06-17

Description

Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.

Frequently asked questions

What is CVE-2021-33596?: Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.
How severe is CVE-2021-33596?: CVE-2021-33596 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2021-33596 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-33596?: CVE-2021-33596 affects F-secure Safe. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-33596?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-33596 published?: CVE-2021-33596 was published on 2021-08-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:f-secure:safe:*:*:*:*:*:iphone_os:*:*

More vulnerabilities in F-secure Safe

CVE-2020-14978 — High (CVSS 8.1): An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can…
CVE-2020-14977 — High (CVSS 8.1): An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client,…
CVE-2019-11644 — High (CVSS 7.8): In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure…
CVE-2022-38164 — Medium (CVSS 6.5): A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could…
CVE-2021-44749 — Medium (CVSS 5.5): A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to…
CVE-2021-44748 — Medium (CVSS 5.5): A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this…

All CVEs affecting F-secure Safe →

Other CWE-1021 vulnerabilities

CVE-2021-43048 — Critical (CVSS 9.8): The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability…
CVE-2021-23274 — Critical (CVSS 9.8): The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution…
CVE-2016-2496 — Critical (CVSS 9.8): The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct…
CVE-2021-21132 — Critical (CVSS 9.6): Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to…
CVE-2021-21111 — Critical (CVSS 9.6): Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a…
CVE-2024-10004 — Critical (CVSS 9.1): Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in…

Browse all CWE-1021 vulnerabilities →