CVE-2023-6345
KEVGoogle Skia Integer Overflow Vulnerability
Description
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HPublishedNov 29, 2023
Last modifiedJun 17, 2026
Added to KEVNov 30, 2023
Remediation dueDec 21, 2023
References
- chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.htmlRelease Notes
- crbug.com/1505053Permissions Required
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/Broken LinkMailing List
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7XQNYZZA3X2LBJF57ZHKXWOMJKNLZYR/Broken LinkMailing List
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJROPNKWW65R34J4IYGTJ7A3OBPUL4IQ/Broken LinkMailing List
- security.gentoo.org/glsa/202401-34Third Party Advisory
- debian.org/security/2023/dsa-5569Mailing List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6345US Government Resource
0 recent articles mention this CVE
80
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1041 days
- CVSS
- 9.6 CRITICAL
- EPSS (30-day exploit probability)
- 16.5% · top 3% of all CVEs
- Weakness
- CWE-190
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.