Google Chromium Intents Improper Input Validation Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2021-38000 · Published 23/11/2021 · updated 17/06/2026

Google Chromium Intents Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

In short

CVE-2021-38000 is a MEDIUM (CVSS 6.1) vulnerability affecting chrome (google).
Exploited in the wild: CISA added it to the KEV catalog on 03/11/2021.
Chance of exploitation in the next 30 days (EPSS): 4.9%, higher than 92.2% of all vulnerabilities.
Fix: update to 95.0.4638.69 or later.

Package	Affected versions	Patched versions
chrome google	`< 95.0.4638.69`	`95.0.4638.69`

Description

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.

References

chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html · Release Notes
crbug.com/1249962 · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744 · Release Notes
debian.org/security/2022/dsa-5046 · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-38000

More vulnerabilities in chrome

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

chrome

google

< 95.0.4638.69

95.0.4638.69

More vulnerabilities in chrome

See all →