CVE-2023-2136
Google Chrome Skia Integer Overflow Vulnerability
Published Apr 18, 2023 · updated Jun 16, 2026 · google chrome
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Timeline
Detection, updates, and resolution for this record.
Apr 18, 2023 · Catalog
Detected
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Apr 21, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 12, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Required action
Apply updates per vendor instructions.
CISA due date May 12, 2023
Affected
- cpe debian/debian linux11.0
- cpe fedoraproject/fedora36
- cpe fedoraproject/fedora37
- cpe fedoraproject/fedora38
- cpe google/chromeversion unspecified
- vendor Google Chromium Skiaversion unspecified
Sources
- CISA KEVCVE-2023-2136
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
cisa.gov - CVE.orgCVE-2023-2136
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-2136
30-day exploitation probability 5.7%
first.org - NIST NVDCVE-2023-2136
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd.nist.gov