Actively exploited · Published Nov 23, 2021 · Assigned by Chrome

CVE-2021-38000

Medium 6.1 Exploited

In plain English

A medium-severity improper input validation in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)4.9%top 7.8% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	chromium	97.0.4692.71-0.1	DEBIAN-CVE-2021-38000
Debian:13	chromium	97.0.4692.71-0.1	DEBIAN-CVE-2021-38000
Debian:14	chromium	97.0.4692.71-0.1	DEBIAN-CVE-2021-38000

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	unspecified – before 95.0.4638.69

Weakness: CWE-20, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html x_refsource_MISC
https://crbug.com/1249962 x_refsource_MISC
FEDORA-2021-6a292e2cf4 vendor-advisory, x_refsource_FEDORA
DSA-5046 vendor-advisory, x_refsource_DEBIAN
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38000 government-resource