CVE-2021-38000

CVE-2021-38000 is an insufficient input validation flaw in the Intents component of Google Chrome on Android (CWE-20/CWE-601), allowing a remote attacker to make the browser navigate to an arbitrary, attacker-chosen URL by luring the user to a crafted HTML page. It is essentially a forced-navigation/open-redirect bug: the user must interact with the malicious page (user interaction required), and the attacker gains limited confidentiality and integrity impact by steering the browser to a malicious URL, which is typically chained with other flaws. The bug was fixed in Chrome 95.0.4638.69 for Android, and the flaw is also tracked against Chromium packages distributed in Fedora and Debian. It carries a CVSS 3.1 score of 6.1 (medium) and an EPSS of 4.7% (91st percentile). Exploitation is confirmed in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and contemporaneous headlines describe Google patching actively exploited Chrome zero-days, with press reports linking Chrome zero-day attacks on Android users to Predator spyware campaigns.

What to do: Update Chrome on Android to version 95.0.4638.69 or later — since Chrome auto-updates, verify the installed version via Settings > About Chrome on managed and BYOD devices. Fedora and Debian users should install the current Chromium/Chrome security updates from their distribution. Inventory mobile fleets and internet-facing kiosk/device estates for Chrome builds below 95.0.4638.69 and treat user lures to crafted web pages as the primary delivery vector.