CVE-2021-38000: medium-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Google Chrome on Android didn't properly check URLs passed through Intents, allowing attackers to trick users into visiting malicious websites by creating a specially crafted HTML page.
Insufficient input validation in Chrome's Intent handler on Android allowed remote attackers to perform open redirect attacks, redirecting users to arbitrary malicious URLs via crafted HTML content. Exploitation requires user interaction with the malicious page and affects versions prior to 95.0.4638.69.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.