CVE-2021-38000: Google Chrome Android Intents input validation open redirect

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable, no-privilege flaw with confirmed in-the-wild exploitation and KEV listing, though the direct impact is limited to redirect and low-severity integrity/confidentiality effects.

What it is

Chrome on Android before 95.0.4638.69 fails to properly validate untrusted input passed through Intents, allowing a crafted HTML page to redirect the browser to an arbitrary malicious URL. It matters because the flaw was exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog, so unpatched Android Chrome users can be steered to attacker-controlled sites.

Impact

An attacker can force the browser to navigate to an arbitrary URL of their choosing, enabling phishing, malware delivery or credential theft on a site the user did not intend to visit. The CVSS vector shows only low confidentiality and integrity impact, so this is a redirect/abuse primitive rather than code execution.

Attack surface

Reached remotely over the network via a crafted HTML page; the vector requires user interaction (UI:R) and no privileges (PR:N), meaning the victim must open or interact with the malicious page in Chrome on Android.

Exploitation

CISA added this to the KEV catalog with a 2021-11-17 remediation due date, and a reference is tagged Exploit, indicating known exploitation; EPSS 30-day probability is about 4.9 percent (91.7th percentile). No ransomware campaign use is documented.

What to do

• Update Chrome on Android to 95.0.4638.69 or later, and apply the corresponding Fedora and Debian security updates.
• Enforce automatic browser updates and verify Android Chrome version compliance across managed devices.
• Block or warn on known malicious and newly registered domains at the network or DNS layer to blunt redirect-based phishing.
• Restrict or monitor link handling from untrusted apps and messages that can trigger Chrome Intents navigation.

Detection

• Monitor Chrome navigation and referrer logs for redirects to untrusted external domains originating from crafted pages.
• Alert on Android Chrome versions below 95.0.4638.69 in endpoint or MDM inventory.
• Hunt proxy and DNS logs for user agents matching Chrome on Android accessing newly registered or low-reputation domains.
• Review phishing reports and URL click telemetry for chains that land on unexpected external sites after an in-app link.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.