CVE-2023-2136
Google Chrome Skia Integer Overflow Vulnerability
Description
CVE-2023-2136 is a critical integer overflow vulnerability in the Skia graphics library used by Google Chrome. Present in Chrome versions prior to 112.0.5615.137, this flaw allows a remote attacker who has already compromised the renderer process to perform a sandbox escape through a specially crafted HTML page. With a CVSS score of 9.6, CVE-2023-2136 poses a severe threat because a successful exploit can break out of Chrome's security sandbox, potentially affecting resources beyond the browser. CISA has confirmed active exploitation in the wild and added this vulnerability to its Known Exploited Vulnerabilities catalog, underscoring the urgency for users of Chrome and Chromium-based browsers to update immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 112.0.5615.137 | |
| debian | debian linux | 11.0 |
| fedoraproject | fedora | 36; 37; 38 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html(Release Notes, Vendor Advisory)
- https://crbug.com/1432603(Issue Tracking, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/(Mailing List)
- https://security.gentoo.org/glsa/202309-17(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5393(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
The integer overflow weakness in CVE-2023-2136 occurs within the Skia graphics engine, where arithmetic operations on integer values exceed the maximum representable value, causing the result to wrap around. In the context of Google Chrome, this integer overflow in Skia can corrupt heap memory, which an attacker with control of the renderer process can leverage to escape the browser sandbox and execute code outside of Chrome's restricted environment.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
CVE-2023-2136 carries a CVSS 3.1 score of 9.6 (Critical), reflecting an exceptionally dangerous exploitation profile. The vulnerability is remotely exploitable over the network without requiring physical access, and the attack complexity is low, meaning the exploit can be triggered reliably. While no authentication is needed to initiate the attack, user interaction is required — the victim must visit a malicious or compromised web page. The scope is changed (S:C), which means a successful exploit can affect resources beyond the vulnerable component, specifically enabling a sandbox escape from Chrome's renderer process to the underlying operating system. Confidentiality, integrity, and availability impacts are all high, as an attacker who escapes the sandbox can read sensitive system data, modify files, and crash or control system processes. The EPSS score of 0.44% indicates that while exploitation probability is moderate, the confirmed active exploitation by CISA means organizations should treat this as an immediate priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-2136 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 12, 2023. While no public proof-of-concept exploit code has been widely circulated through major exploit databases, the Chromium bug tracker entry crbug.com/1432603 provides technical details about the flaw. The EPSS score of 0.44% (63rd percentile) suggests relatively moderate exploitation probability in the broader landscape, but the confirmed in-the-wild exploitation and the high value of Chrome sandbox escapes to advanced threat actors make this a critical priority. Ransomware usage is currently unknown for this vulnerability.
Remediation
- Update Google Chrome immediately to version 112.0.5615.137 or later. CISA directs organizations to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Chrome can be updated through the browser's built-in update mechanism (Settings > About Chrome).
- Update Chromium-based browsers and applications that embed the Skia graphics library, including Microsoft Edge, Brave, Opera, and Vivaldi. Debian Linux users should apply the patch from DSA-5393, and Fedora users should install updates from the relevant Fedora package announcements.
- Enable automatic browser updates across the organization through group policy or endpoint management tools to ensure future Chromium security patches are applied without delay. For enterprise environments, configure Chrome Browser Cloud Management policies to enforce minimum version requirements.
- Monitor for signs of compromise by reviewing endpoint detection logs for anomalous process creation originating from browser renderer processes, which could indicate a sandbox escape attempt. Pay attention to unexpected child processes spawned by Chrome or Chromium-based browsers.
- Implement browser isolation solutions for high-risk users who access untrusted web content, providing an additional layer of defense against browser-based exploits that target rendering engine vulnerabilities like integer overflows in Skia.
Technical Details
CVE-2023-2136 is an integer overflow vulnerability (CWE-190) within the Skia 2D graphics library, which Chrome uses for rendering graphical content including text, images, and SVG elements. The integer overflow occurs when arithmetic operations on integer values produce a result that exceeds the data type's maximum capacity, causing it to wrap around to an unexpected value. The attack vector is network-based (AV:N) with low complexity (AC:L), and while no privileges are required (PR:N), the attacker must first compromise the renderer process and the victim must interact (UI:R) by visiting a crafted HTML page. The scope is changed (S:C), indicating the exploit transcends the renderer sandbox boundary. Once the integer overflow is triggered in Skia, it corrupts heap memory structures, which a pre-positioned attacker (one who has already gained code execution in the renderer) can leverage to break out of Chrome's multi-process sandbox architecture and execute code with the privileges of the browser process or the underlying operating system.
Frequently Asked Questions
Is CVE-2023-2136 being actively exploited?
Yes, CVE-2023-2136 is confirmed to be actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of May 12, 2023. While ransomware association is currently unknown, the sandbox escape capability makes it highly valuable to advanced attackers.
What products are affected by CVE-2023-2136?
CVE-2023-2136 affects Google Chrome versions prior to 112.0.5615.137 on all platforms. Additionally, Debian Linux and Fedora distributions that package Chromium are affected. Any application or browser built on the Chromium engine that uses the vulnerable version of the Skia graphics library is also potentially impacted.
How do I fix CVE-2023-2136?
Update Google Chrome to version 112.0.5615.137 or later through the built-in update mechanism. For Linux distributions, apply the relevant security patches (Debian DSA-5393 or Fedora package updates). Also update any other Chromium-based browsers such as Microsoft Edge, Brave, or Opera.
How severe is CVE-2023-2136?
CVE-2023-2136 is rated Critical with a CVSS 3.1 score of 9.6 out of 10. The scope-changed designation means a successful exploit can break out of Chrome's sandbox to affect the underlying system. While user interaction (visiting a malicious page) is required, the attack complexity is low and no authentication is needed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.