CVE-2023-6345

An integer overflow error in the Skia component (2D graphics library used by Chrome) allows an attacker who has gained control of the browser's renderer process to escape sandbox isolation. The attack is initiated by tricking a user into opening a malicious file, which triggers an integer overflow during graphics data processing. Successful overflow can lead to code execution outside the protected renderer environment.

An attacker who has previously compromised a renderer process can potentially escape the Chrome sandbox and gain fuller access to the operating system, including code execution with higher privileges and compromise of confidentiality, integrity, and availability of data.

Google Chrome must be updated immediately to version 119.0.6045.199 or later. Users of Debian Linux and Fedora distributions should apply patches available in repositories according to vendor references. Due to active exploitation of the vulnerability, the update should be performed immediately.

Google Chrome in versions earlier than 119.0.6045.199, as well as Chrome/Chromium packages for Debian Linux and Fedora (indicated distribution versions in vendor references)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.