Log in Start free

Actively exploited · Published Apr 19, 2023 · Assigned by Chrome

CVE-2023-2136

Critical 9.6 Exploited

In plain English

A critical-severity integer overflow in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on April 21, 2023). The chance it is exploited in the next 30 days is estimated at 5.8% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)5.8%top 6.9% of all CVEs
Exploited in the wildYesCISA KEV since Apr 21, 2023
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 12, 2023.

Official description

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12chromium112.0.5615.138-1DEBIAN-CVE-2023-2136
Debian:13chromium112.0.5615.138-1DEBIAN-CVE-2023-2136
Debian:14chromium112.0.5615.138-1DEBIAN-CVE-2023-2136

Affected products (as reported)

VendorProductVersions
Google Chrome 112.0.5615.137 – before 112.0.5615.137

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References