CVE-2021-38000 is a critical vulnerability in Google Chrome on Android, affecting versions prior to 95.0.4638.69, as well as Debian and Fedora. It stems from insufficient validation of untrusted input in Intents, allowing a remote attacker to redirect users to malicious URLs via a crafted HTML page. Rated 6.1 MEDIUM on CVSS, this vulnerability has a low attack complexity and requires user interaction, but can lead to information disclosure and data integrity issues. Its FAUCET Risk Score of 97/100 and EPSS score of 0.031950000 indicate a significant threat. This CVE is actively exploited in the wild, as confirmed by its presence in the KEV catalog and extensive media coverage, including reports of its use in Predator spyware attacks. While no public exploit code is available via Metasploit, Nuclei, or ExploitDB, it has garnered substantial community discussion, indicating high awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 95.0.4638.69CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.