CVE-2021-38000: Google Chromium Intents Improper Input Validation Vulnerability
Vulnerability summary
CVE-2021-38000 is a medium (CVSS 6.1) Open Redirect vulnerability in Google Chromium Intents. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 4.95% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 03-11-2021Added to CISA KEVGoogle Chromium Intents Improper Input Validation Vulnerability
- 17-11-2021CISA remediation dueApply updates per vendor instructions.
- 23-11-2021PublishedVulnerability first disclosed.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
4.95%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.95% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 17-11-2021
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-38000
Public exploits
1 foundExploit Reference (crbug.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Debian2 products
- chromium< 97.0.4692.71-0.1
- debian_linuxEOL10.0 | 11.0
Fedoraproject1 product
- fedoraEOL34
Google1 product
- chrome≥ unspecified, < 95.0.4638.69 | < 95.0.4638.69
Ubuntu1 product
- chromium-browser< 95.0.4638.69-0ubuntu0.18.04.1
4 vendors · 5 products
References
9 links- chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.htmlX Refsource MISCRelease Notes
www.debian.org/security/2022/dsa-5046Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38000Government ResourceUS Government Resource