← Vulnerability Intelligence

CVE-2023-6345

Critical 9.6 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Google Skia Integer Overflow Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

Metrics

CVSS 3.1
9.6 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS — exploit probability
16% (percentile: 97) as of 2 November 2026
CWE
CWE-190

Affected products

google: chrome; debian: debian linux; fedoraproject: fedora; microsoft: edge chromium

References