CVE-2021-38000
Google Chromium Intents Improper Input Validation Vulnerability
Description
CVE-2021-38000 is a medium-severity url redirection to untrusted site ('open redirect') vulnerability affecting Google Chromium Intents. Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 3.19% (86.8th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 95.0.4638.69 | |
| fedoraproject | fedora | 34 |
| debian | debian linux | 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html(Release Notes)
- https://crbug.com/1249962(Exploit, Issue Tracking)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/(Release Notes)
- https://www.debian.org/security/2022/dsa-5046(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38000(US Government Resource)
Weakness Type
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
URL Redirection to Untrusted Site occurs when a web application accepts a user-controlled input that specifies a link to an external site and uses that link to redirect the user. This allows attackers to craft URLs that appear to point to the legitimate site but redirect victims to malicious sites.
Learn more: CWE-601 — URL Redirection to Untrusted Site ('Open Redirect')
CWE-20: Improper Input Validation
Improper Input Validation is a software weakness where a product receives input or data but does not validate or incorrectly validates that the input has the properties required to process data safely and correctly. This vulnerability occurs when applications accept user-supplied data without verifying that it conforms to expected formats, lengths, types, or ranges.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2021-38000 carries a CVSS 3.1 score of 6.1 (MEDIUM), indicating a high-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation can partially expose sensitive data, and allow limited data modification. The scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself, amplifying the overall damage. Organizations running affected Chromium-based browsers face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-38000 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 3.19% (86.8th percentile) indicates a measurable probability of exploitation. The vulnerability affects a widely deployed browser engine, increasing the pool of potential targets. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Update all Chromium-based browsers (Google Chrome, Microsoft Edge, Opera, and others) to the latest stable version that addresses this vulnerability.
- If immediate patching is not possible, restrict access to untrusted web content and consider disabling the affected browser component where feasible.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-38000 affects Google Chromium Intents. Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely by luring a victim to visit a specially crafted webpage. The CVSS score of 6.1 reflects the combination of low attack complexity, no required privileges, and low impact across confidentiality, integrity.
Frequently Asked Questions
Is CVE-2021-38000 being actively exploited?
Yes. CVE-2021-38000 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 3.19% (86.8th percentile) further indicates a measurable exploitation probability.
What products are affected by CVE-2021-38000?
CVE-2021-38000 affects Google Chromium Intents. Since the vulnerability resides in the Chromium engine, multiple browsers that utilize Chromium may be affected, including Google Chrome, Microsoft Edge, and Opera.
How do I fix CVE-2021-38000?
Apply updates per vendor instructions. Ensure all Chromium-based browsers are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure to untrusted web content.
How severe is CVE-2021-38000?
CVE-2021-38000 has a CVSS 3.1 score of 6.1 (MEDIUM). This is a medium-severity vulnerability that requires timely attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.