PT-2023-1006 · Google+3 · Skia+4
Clément Lecigne
·
Publicado
2023-04-18
·
Atualizado
2025-12-04
·
CVE-2023-2136
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 112.0.5615.137
Description
The issue is caused by an integer overflow in the Skia library of Google Chrome, potentially allowing a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. This could lead to remote code execution in an unprivileged app with no additional execution privileges needed, but user interaction is required for exploitation. The vulnerability has been exploited in the wild.
Recommendations
For Google Chrome versions prior to 112.0.5615.137, update to version 112.0.5615.137 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable
SkSLFunctionDefinition.cpp functions until a patch is applied. Avoid using crafted HTML pages that could trigger the integer overflow in the Skia library.Correção
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Google Chrome
Skia
Suse