Google · Chromium Skia
CVE-2023-6345
Google Skia Integer Overflow Vulnerability
What it is
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
CISA: Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: December 21, 2023
- Added to the CISA list
- November 30, 2023
- Published
- November 29, 2023
- Severity
- Critical 9.6 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 16% in the top 3.0% of all known vulnerabilities
- Weakness
- CWE-190
- More details
- NVD · CVE.org · CISA
All references (7)
- https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html
- https://crbug.com/1505053
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJROPNKWW65R34…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHV…
- https://www.debian.org/security/2023/dsa-5569
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7XQNYZZA3X2LB…
- https://security.gentoo.org/glsa/202401-34
More exploited flaws from Google
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 21, 2023 | Chrome Skia Integer Overflow | Chromium Skia | Critical 9.6 | 5.7% |
| Oct 27, 2026 | Unchecked Return Value | Brotli | Critical 9.2 | 55% |
| Sep 16, 2026 | Improper Authorization | Pixel | High 8.8 | 0.6% |
| Sep 9, 2026 | Out of Bounds Write | Chromium V8 | High 8.8 | 3.5% |
| Sep 4, 2026 | Type Confusion | Chromium V8 | High 8.8 | 1.8% |
| Jun 9, 2026 | Out-of-Bounds Read and Write | Chromium V8 | High 8.8 | 2.4% |
| Apr 1, 2026 | Use-After-Free | Dawn | High 8.8 | 14% |
| Mar 13, 2026 | Out-of-Bounds Write | Skia | High 8.8 | 2.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.