CVE-2023-6345: Google Skia Integer Overflow Vulnerability
CVE-2023-6345 · Severity: critical · CVSS 9.6 · Exploited in the wild · Published 2023-11-30
An integer overflow vulnerability in the Skia graphics library allows a remote attacker who has compromised the renderer process to perform a sandbox escape via a malicious file. This vulnerability has been observed being exploited in the wild.
Yes. CVE-2023-6345 is known to be exploited in the wild, first recorded on 30 November 2023. Treat it as urgent.
How severe is CVE-2023-6345?
Critical severity, with a CVSS score of 9.6, published 30 November 2023.
Which products and versions are affected?
Google Skia; Google Chrome prior to 119.0.6045.199; Google ChromeOS; Google Android; and 1 more.
Is there a fix for CVE-2023-6345?
A patch was published on 2023-11-28: Chrome stable channel update 119.0.6045.199 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-6345 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-6345?
Check whether you run Google Chromium Skia. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.