# CVE-2021-38000: Chrome Intents Logic Flaw

Chrome auto-followed 302 redirects to intent:// URLs, letting a server launch an attacker-chosen app with attacker data without user consent, escaping the Chrome sandbox.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Maddie Stone, Google Project Zero
- Disclosed: 2021-10-28
- CVE: CVE-2021-38000
- Write-up quality: 7/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-38000.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-38000
- Tags: domain:browser domain:mobile impact:internal-access kind:incident platform:project-zero sev:high tech:android technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Chrome for Android intent URL handling / external app launch
**Root cause:** Chrome triggered Android intents to external apps on server-driven 302 redirects to intent:// URLs, rather than requiring a user gesture; the destination app and data were fully server-controlled.
**Steps:**
1. Serve a 302 redirect whose Location is `intent://<ORIG_URL>#Intent;scheme=https;package=com.sec.android.app.sbrowser;S.browser_fallback_url=<URL2>;end`
2. Victim clicks a link pointing at the attacker server
3. Chrome follows the 302 and launches the named package (e.g. Samsung browser) with attacker-supplied URL
4. Attacker then serves Chrome n-day exploits to the outdated embedded browser
**How found:** Likely via reading prior Android intent-scheme security research (Terada 2014 whitepaper) and testing intent URL variants against the spec, noticing intents fired without user gesture.
**Exploitation:** Attacker-controlled server returns a 302 to an intent:// URL naming a target package (Samsung browser) and a fallback URL. Chrome launches that app with the attacker URL without user consent, moving execution out of Chrome's sandbox into an outdated Chromium-based browser where known n-days apply.
**Escalation:** Chained: intent redirect escapes Chrome sandbox into Samsung browser running a 6-month-old Chromium, then Chrome n-days exploited the user.
**Insight:** Deep-link/intent handlers that fire on server-driven redirects (not user gestures) are a consent-bypass primitive; audit every intent URL format and check whether a 302 alone can trigger app launch.