{"id":"CVE-2023-2136","published":"2023-04-19T04:15:31Z","modified":"2026-06-17T05:51:32Z","title":"Google Chrome Skia Integer Overflow Vulnerability","vendor":"Google","product":"Chromium Skia","tier":"core","eol":null,"description":{"text":"Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an integer overflow in the Skia graphics component of Google Chrome (Chromium Skia), which affects Chrome builds prior to 112.0.5615.137. An attacker who has already compromised the renderer process and can serve a crafted HTML page to the victim could potentially escape the browser sandbox, and exploitation requires that the user visit the malicious page over the network without authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:52Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.05786,"percentile":0.93081,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-04-21","dueDate":"2023-05-12","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-2136","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-12","exploitedFirstSeen":"2023-04-12","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-04-21"},{"url":"https://securelist.com/it-threat-evolution-q2-2023-non-mobile-statistics/110413/","date":"2023-08-30"},{"url":"https://ti.qianxin.com/uploads/2024/02/02/dcc93e586f9028c68e7ab34c3326ff31.pdf","date":"2024-02-02"},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf","date":"2024-02-06"},{"url":"https://thehackernews.com/2024/02/global-coalition-and-tech-giants-unite.html","date":"2024-02-07"},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Year_in_Review_of_ZeroDays.pdf","date":"2024-03-27"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://crbug.com/1432603","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/","tags":["Mailing List"]},{"url":"https://security.gentoo.org/glsa/202309-17","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5393","tags":["Third Party Advisory"]},{"url":"https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://crbug.com/1432603","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/","tags":["Mailing List"]},{"url":"https://security.gentoo.org/glsa/202309-17","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5393","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Integer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This integer overflow vulnerability is exploited by a remote attacker who has already compromised the renderer process of Google Chrome. Exploiting this vulnerability might lead to incorrect rendering, memory corruption, and arbitrary code execution that could grant the adversary unauthorized access to the system. \n\nExploitation in the wild techniques have not been publicly released to reduce further abuse. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-33656","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33656","exploited":true,"exploitedSince":"2023-04-21","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"source"}],"timeline":[{"date":"2023-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2023-04-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2136","provenance":"source"},{"date":"2023-04-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-04-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33656","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":2},"priority":{"score":63.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1296 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.62,"detail":"percentile 0.9308"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-google-chrome-cwe-190"}}