CVE-2023-6345
Google Skia Integer Overflow Vulnerability
Description
CVE-2023-6345 is a CRITICAL integer overflow vulnerability in the Skia graphics library used by Google Chrome, rated 9.6 on the CVSSv3.1 scale. The flaw exists in Chrome's Skia rendering engine and allows a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox via a malicious file. The vulnerability affects Google Chrome versions prior to 119.0.6045.199 and was actively exploited in the wild, earning inclusion in CISA's Known Exploited Vulnerabilities catalog with a December 21, 2023 remediation deadline. Microsoft Edge (Chromium-based) and Debian and Fedora Linux packages incorporating Chromium are also affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 119.0.6045.199 | |
| debian | debian linux | 11.0; 12.0 |
| fedoraproject | fedora | 37; 38; 39 |
| microsoft | edge chromium | < 119.0.2151.97 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html(Release Notes)
- https://crbug.com/1505053(Permissions Required)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/(Broken Link, Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/C7XQNYZZA3X2LBJF57ZHKXWOMJKNLZYR/(Broken Link, Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UJROPNKWW65R34J4IYGTJ7A3OBPUL4IQ/(Broken Link, Mailing List)
- https://security.gentoo.org/glsa/202401-34(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5569(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6345(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, a numeric error where an arithmetic operation produces a value exceeding the maximum for the data type, causing it to wrap around to a very small or negative value. In CVE-2023-6345, the integer overflow occurs in Chrome's Skia graphics library during the processing of a malicious file. When integer overflow results in incorrect buffer size calculations, subsequent memory operations may write or read outside allocated bounds, potentially corrupting memory in ways that allow an attacker to escape the browser's sandbox. Integer overflows in rendering engines are a particularly dangerous class of bug because they can be triggered through crafted graphical content delivered via the web.
Impact Analysis
With a CVSS score of 9.6 (CRITICAL) and a Changed scope (S:C), this vulnerability's impact extends beyond the WebKit or Skia process into the broader system. A successful exploit by an attacker who has already compromised the renderer process can achieve a sandbox escape, effectively allowing the attacker to break out of Chrome's security isolation and execute code with the privileges of the browser's main process or the underlying operating system user. All three impact dimensions — confidentiality, integrity, and availability — are rated HIGH, reflecting the potential for complete system compromise. The attack vector is network-based with low complexity, and while user interaction (browsing to malicious content) is required, no attacker privileges are needed. The sandbox escape aspect makes this particularly dangerous since Chrome's multi-process sandbox architecture is a primary defense against browser-based exploitation.
Exploit Maturity
CVE-2023-6345 was confirmed as actively exploited in the wild at the time of Google's disclosure on November 28, 2023. The EPSS score of 0.00611 (69th percentile) indicates elevated exploitation probability relative to most CVEs, though still reflecting the targeted nature of Chrome sandbox escapes. CISA's KEV inclusion with a December 21, 2023 deadline mandated rapid remediation for federal systems. The exploit context — requiring a prior renderer compromise — suggests this was used as a second stage in a multi-step exploitation chain, likely targeting high-value individuals or organizations. The 69th-percentile EPSS ranking confirms this as a meaningfully higher-risk vulnerability than the majority of publicly disclosed CVEs.
Remediation
- Update Google Chrome immediately: Install version 119.0.6045.199 or later, which patches the integer overflow in Skia. Navigate to Chrome menu > Help > About Google Chrome to trigger an update check.
- Update Microsoft Edge: Microsoft Edge (Chromium-based) is similarly affected; apply the corresponding Edge update from Microsoft.
- Apply Linux distribution patches: Debian users should apply DSA-5569; Fedora users should install the updated Chromium packages from their respective package advisories.
- Follow CISA KEV guidance: Organizations subject to CISA directives must remediate per vendor instructions by the December 21, 2023 deadline or discontinue use of the affected product.
- Enforce browser update policies: Use enterprise management tools (Google Admin, Microsoft Intune) to enforce automatic browser updates and minimum version requirements.
- Assess renderer compromise vectors: Since full exploitation requires a prior renderer compromise, review exposure to other Chromium renderer vulnerabilities and ensure endpoint detection capabilities are active.
Technical Details
CVE-2023-6345 is an integer overflow in Chrome's Skia 2D graphics library (libskia), which is responsible for rendering graphics content including images, canvas elements, and PDF rendering within the browser. During the processing of a malicious file, an arithmetic operation on an integer value overflows, producing an incorrect result used to calculate memory buffer sizes or offsets (CWE-190). This incorrect calculation can lead to an out-of-bounds memory access that disrupts the Skia process's memory layout in ways that allow an attacker who already controls the renderer to achieve a sandbox escape. The CVSSv3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H with Changed scope reflects the cross-process impact of a successful sandbox escape. Exploitation requires prior compromise of the Chrome renderer process, making this a second-stage exploit used after an initial renderer vulnerability. Affected versions include all Google Chrome releases prior to 119.0.6045.199, Microsoft Edge Chromium builds incorporating the vulnerable Skia version, and Chromium packages shipped by Debian (DSA-5569) and Fedora.
Frequently Asked Questions
Who is affected by CVE-2023-6345?
All users running Google Chrome prior to version 119.0.6045.199, Microsoft Edge (Chromium) prior to the corresponding patched release, and Chromium-based browsers on Debian or Fedora Linux without the respective distribution security patches are affected.
What makes a sandbox escape particularly dangerous?
Chrome uses a multi-process architecture where web content runs in isolated renderer processes with restricted OS permissions (the sandbox). A sandbox escape allows an attacker to break out of this isolation and execute code in the less-restricted browser process or operating system context, potentially accessing files, credentials, and system resources that the sandboxed renderer process cannot reach.
Does exploiting this vulnerability require prior access?
Yes. The sandbox escape component of CVE-2023-6345 requires that an attacker has already compromised the Chrome renderer process — for example, through a separate renderer exploit. This makes it a chained exploit, typically used as the second stage in a multi-step browser attack. However, this pre-condition does not reduce urgency, as renderer exploits are regularly discovered and CVE-2023-6345 significantly increases the potential damage of any renderer compromise.
How can I verify my Chrome version and check if I am patched?
Open Google Chrome and navigate to the menu (three dots in the top right) > Help > About Google Chrome. Chrome will display the current version and automatically check for updates. Ensure the installed version is 119.0.6045.199 or later to be protected against CVE-2023-6345.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.