ZeroDay Findings
Sign inSign up

Findings

CVE-2023-6345

Google Skia Integer Overflow Vulnerability

Published Nov 29, 2023 · updated Jun 16, 2026 · google chrome

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 29, 2023 · Catalog

    Detected

    Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

  2. Nov 30, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Dec 21, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Dec 21, 2023

Affected

  • cpe debian/debian linux11.0
  • cpe debian/debian linux12.0
  • cpe fedoraproject/fedora37
  • cpe fedoraproject/fedora38
  • cpe fedoraproject/fedora39
  • cpe google/chromeversion unspecified
  • cpe microsoft/edge chromiumversion unspecified
  • vendor Google Chromium Skiaversion unspecified

Sources

  • CISA KEVCVE-2023-6345

    Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

    cisa.gov
  • CVE.orgCVE-2023-6345

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-6345

    30-day exploitation probability 16.5%

    first.org
  • NIST NVDCVE-2023-6345

    Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

    nvd.nist.gov

References