Google Skia Integer Overflow Vulnerability

CRITICAL 9.6EXPLOITED (CISA KEV)CVE-2023-6345 · Published 29/11/2023 · updated 17/06/2026

Google Skia Integer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 30/11/2023. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
chrome google	`< 119.0.6045.199`	`119.0.6045.199`
edge chromium microsoft	`< 119.0.2151.97`	`119.0.2151.97`

Description

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

References

chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html · Release Notes
crbug.com/1505053 · Permissions Required
lists.fedoraproject.org/archives/list/[email protected]/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2 · Broken Link
lists.fedoraproject.org/archives/list/[email protected]/message/C7XQNYZZA3X2LBJF57ZHKXWOMJKNLZYR · Broken Link
lists.fedoraproject.org/archives/list/[email protected]/message/UJROPNKWW65R34J4IYGTJ7A3OBPUL4IQ · Broken Link
security.gentoo.org/glsa/202401-34 · Third Party Advisory
debian.org/security/2023/dsa-5569 · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-6345

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free