NetSight
IP …
critical9.6Known exploited

CVE-2023-6345

Google Skia Integer Overflow Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-11-30. Federal due date: 2023-12-21.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

Affected products

VendorProductAffected versions
GoogleChrome
before 119.0.6045.199
DebianDebian Linux
Versions 11.0, 12.0
FedoraprojectFedora
Versions 37, 38, 39
MicrosoftEdge Chromium
before 119.0.2151.97

Weakness classification

CWE-190

References