CVE-2023-6345

CriticalCVSS 9.6/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Google	Chrome	>= 119.0.6045.199, < 119.0.6045.199

References

https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.htmlRelease Notes
https://crbug.com/1505053Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/Broken Link, Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7XQNYZZA3X2LBJF57ZHKXWOMJKNLZYR/Broken Link, Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJROPNKWW65R34J4IYGTJ7A3OBPUL4IQ/Broken Link, Mailing List
https://security.gentoo.org/glsa/202401-34Third Party Advisory
https://www.debian.org/security/2023/dsa-5569Mailing List
https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.htmlRelease Notes
https://crbug.com/1505053Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/Broken Link, Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7XQNYZZA3X2LBJF57ZHKXWOMJKNLZYR/Broken Link, Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJROPNKWW65R34J4IYGTJ7A3OBPUL4IQ/Broken Link, Mailing List
https://security.gentoo.org/glsa/202401-34Third Party Advisory
https://www.debian.org/security/2023/dsa-5569Mailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6345US Government Resource

Timeline

Published: Nov 29, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 30, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-63468.8Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2023-63478.8Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2023-63488.8Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to CVE-2023-63497.5A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 ma CVE-2023-63508.8Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2023-63518.8Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2023-63525.3The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet I CVE-2023-63539.4Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by mani CVE-2023-63549.4Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by man CVE-2023-63556.8Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local d CVE-2023-63567.5A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP pac CVE-2023-63578.8A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could