CVE-2021-38000

Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 23 Nov 2021, 21:30
Last modified:21 Oct 2025, 23:25

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
6.1 MEDIUM
v3.1 (cve.org)
EPSS Score
4.5% LOW
5% probability +1.31%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

23 Nov 2021, 21:30
Published
Vulnerability first disclosed
03 Nov 2021, 00:00
Added to CISA KEV
Google Chromium Intents Improper Input Validation Vulnerability
17 Nov 2021, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
21 Oct 2025, 23:25
Last Modified
Vulnerability information updated

Description

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS Trends

Current EPSS score: 4.50%• Percentile: 89%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-601•URL Redirection to Untrusted Site ('Open Redirect')

    The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected Systems

  • debian•debian_linux

    10.0 | 11.0

  • fedoraproject•fedora

    34

  • Unknown•Chrome

    < 95.0.4638.69 | ≥ unspecified, < 95.0.4638.69

References (5)