CVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0...
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
CVE-2021-38000- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601, CWE-20
- Updated
- 2026-11-02
CVE List
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
CVE-2021-38000- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2021-24473
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
EUVD-2021-24473- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xrj7-4gfh-q9h7
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0...
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
GHSA-xrj7-4gfh-q9h7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-601
- Updated
- 2026-11-02
CISA KEV No score
Google Chromium Intents Improper Input Validation Vulnerability
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Record
CVE-2021-38000- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
CVE-2021-38000- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
DEBIAN-CVE-2021-38000- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- Record
UBUNTU-CVE-2021-38000- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1462-1 No score
Security update for chromium
This update for chromium fixes the following issues:
Chromium 95.0.4638.69 (boo#1192184):
- CVE-2021-37997: Use after free in Sign-In
- CVE-2021-37998: Use after free in Garbage Collection
- CVE-2021-37999: Insufficient data validation in New Tab Page
- CVE-2021-38000: Insufficient validation of untrusted input in Intents
- CVE-2021-38001: Type Confusion in V8
- CVE-2021-38002: Use after free in Web Transport
- CVE-2021-38003: Inappropriate implementation in V8
- Record
openSUSE-SU-2021:1462-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11604-1 No score
chromedriver-95.0.4638.69-1.1 on GA media
These are all security issues fixed in the chromedriver-95.0.4638.69-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11604-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 |
before 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
chromiumDebian:13 |
before 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
chromiumDebian:14 |
before 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
chromiumDebian:11 From an advisory covering 123 CVEs |
before 97.0.4692.71-0.1~deb11u1, plus listed versions 90.0.4430.212-193.0.4577.82-1 |
97.0.4692.71-0.1~deb11u1 |
chromium-browserUbuntu:18.04:LTS |
before 95.0.4638.69-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
95.0.4638.69-0ubuntu0.18.04.1 |
chromiumSUSE:Package Hub 15 SP3 From an advisory covering 7 CVEs |
before 95.0.4638.69-bp153.2.40.3 | 95.0.4638.69-bp153.2.40.3 |
chromiumopenSUSE:Leap 15.2 From an advisory covering 7 CVEs |
before 95.0.4638.69-bp153.2.40.3 | 95.0.4638.69-bp153.2.40.3 |
chromiumopenSUSE:Leap 15.3 From an advisory covering 7 CVEs |
before 95.0.4638.69-bp153.2.40.3 | 95.0.4638.69-bp153.2.40.3 |
chromiumopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 95.0.4638.69-1.1 | 95.0.4638.69-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38000 is a medium vulnerability (CVSS 6.1) in Google Android, published November 8, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.95%, the 92nd percentile. Fixed in chromium 97.0.4692.71-0.1.
References
chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html
crbug.com/1249962
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744
debian.org/security/2022/dsa-5046
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38000
nvd.nist.gov/vuln/detail/CVE-2021-38000
Show 194 moreShow less
github.com/advisories/GHSA-xrj7-4gfh-q9h7
security-tracker.debian.org/tracker/CVE-2021-38000
ubuntu.com/security/CVE-2021-38000
cve.org/CVERecord?id=CVE-2021-38000
lists.opensuse.org/archives/list/[email protected]/thread/LILU2Q77SAPFWPTS2P4ZOLY6WZ3NJCJN
bugzilla.suse.com/1192184
suse.com/security/cve/CVE-2021-37997
Left out here: 9 versions and 2,124 references. The JSON record has them.