CVE-2023-2136 Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (C...
CriticalCVSS 9.6
EPSS 5.8%
CISA KEV
added 2023-04-21 · due 2023-05-12
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CISA Known Exploited Vulnerability
- Date added
- 2023-04-21
- Due date (FCEB)
- 2023-05-12
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/chromium(Debian:12) | < 112.0.5615.138-1 | 112.0.5615.138-1 |
| debian/chromium(Debian:13) | < 112.0.5615.138-1 | 112.0.5615.138-1 |
| debian/chromium(Debian:14) | < 112.0.5615.138-1 | 112.0.5615.138-1 |
| Google Chrome | >= 112.0.5615.137, < 112.0.5615.137 | 112.0.5615.137 |
| Google Chrome | < 112.0.5615.137 | 112.0.5615.137 |
| debian linux | = 11.0 | No fix listed |
| fedoraproject fedora | = 36 | No fix listed |
| fedoraproject fedora | = 37 | No fix listed |
| fedoraproject fedora | = 38 | No fix listed |
References
- Debian Security Tracker CVE-2023-2136 vendor-advisory
- chromereleases.googleblog.com release-notes vendor-advisory
- crbug.com issue-tracking third-party-advisory
- lists.fedoraproject.org mailing-list
- lists.fedoraproject.org mailing-list
- lists.fedoraproject.org mailing-list
- www.debian.org third-party-advisory
- lists.fedoraproject.org mailing-list
- lists.fedoraproject.org mailing-list
- lists.fedoraproject.org mailing-list
- security.gentoo.org third-party-advisory
- www.cisa.gov government-resource us-government-resource