CVE-2023-6345: Integer overflow in Skia

Published Nov 24, 2023
·
Updated

Chromium: CVE-2023-6345 Integer overflow in Skia

Other sources

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

— CISA

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2023-6345 exists in the wild.

— Microsoft

Credit

Benoît Sevens(Google's Threat Analysis Group), Clément Lecigne(Google's Threat Analysis Group)

Affected Software

15 affected componentsFixes available
debian/chromium<=90.0.4430.212-1~deb10u1, <=116.0.5845.180-1~deb11u1
120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1
Google Chromium Skia
Microsoft Edge (Chromium-based)
Patch available
Microsoft Edge<119.0.2151.97
Google Chrome=120.0.6099.224
Google Chrome=120.0.6099.225
Google Chrome=120.0.6099.234
Google Chrome<119.0.6045.199
119.0.6045.199
Google Chrome<119.0.6045.199
Debian Debian Linux=11.0
Debian Debian Linux=12.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Fedoraproject Fedora=39
Microsoft Edge Chromium<119.0.2151.97

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1
  2. Upgrade

    Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.

    Fixed in 119.0.6045.199
  3. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 120.0.6099.129-1~deb11u1
  4. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 119.0.6045.199-1~deb12u1
  5. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 120.0.6099.129-1~deb12u1
  6. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 120.0.6099.129-1
  7. Compensating control

    Discontinue use of the product if mitigations are unavailable.

Event History

Nov 24, 2023
CVE Published
12:00 AM
Known Exploited
12:00 AM
Nov 28, 2023
News Published
09:24 PM
Nov 29, 2023
CVE Published
via MITRE·12:02 PM
Data Sourced
via MITRE·12:02 PM
DescriptionWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 30, 2023
News Published
08:45 PM
Dec 1, 2023
News Published
09:31 PM
Dec 2, 2023
News Published
02:05 PM
Dec 20, 2023
News Published
09:41 PM
Jan 16, 2024
News Published
via BleepingComputer·07:13 PM
Jan 20, 2024
News Published
via BleepingComputer·07:14 PM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2023-6345?

CVE-2023-6345 is an integer overflow vulnerability in Skia in Google Chrome prior to version 119.0.6045.199.

2

How severe is CVE-2023-6345?

CVE-2023-6345 has a high severity rating according to Chromium.

3

Which software is affected by CVE-2023-6345?

Microsoft Edge (Chromium-based) versions up to 119.0.2151.97 are affected by CVE-2023-6345.

4

Can a remote attacker exploit CVE-2023-6345?

Yes, a remote attacker who has compromised the renderer process can potentially perform a sandbox escape using a malicious file.

5

How can I fix CVE-2023-6345 in Microsoft Edge (Chromium-based)?

To fix CVE-2023-6345 in Microsoft Edge (Chromium-based), update to version 119.0.2151.97 or later.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203