CVE-2021-38000
Google Chromium Intents Improper Input Validation Vulnerability
Published Nov 3, 2021 · updated Jun 16, 2026 · google chrome
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Timeline
Detection, updates, and resolution for this record.
Nov 3, 2021 · Catalog
Detected
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe fedoraproject/fedora34
- cpe google/chromeversion unspecified
- vendor Google Chromium Intentsversion unspecified
Sources
- CISA KEVCVE-2021-38000
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
cisa.gov - CVE.orgCVE-2021-38000
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-38000
30-day exploitation probability 4.9%
first.org - NIST NVDCVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
nvd.nist.gov