PT-2023-1006 · Google+3 · Skia+4
Clément Lecigne
·
Published
2023-04-18
·
Updated
2025-12-04
·
CVE-2023-2136
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 112.0.5615.137
Description
The issue is caused by an integer overflow in the Skia library of Google Chrome, potentially allowing a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. This could lead to remote code execution in an unprivileged app with no additional execution privileges needed, but user interaction is required for exploitation. The vulnerability has been exploited in the wild.
Recommendations
For Google Chrome versions prior to 112.0.5615.137, update to version 112.0.5615.137 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable
SkSLFunctionDefinition.cpp functions until a patch is applied. Avoid using crafted HTML pages that could trigger the integer overflow in the Skia library.Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Google Chrome
Skia
Suse