Vulnerability record · CVE-2023-2136 · published 19 April 2023
CVE-2023-2136: Google Chrome Skia integer overflow enables sandbox escape
Google · Chrome
An integer overflow in the Skia graphics library in Google Chrome before 112.0.5615.137 lets an attacker who already controls the renderer process escape the browser sandbox using a crafted HTML page. Because it breaks the sandbox boundary, it turns a renderer compromise into a full host compromise, which is why it was added to CISA KEV.
Description
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.6, CISA KEV listing with known exploitation, and a sandbox escape that escalates renderer compromise to host-level impact.
What it is
An integer overflow in the Skia graphics library in Google Chrome before 112.0.5615.137 lets an attacker who already controls the renderer process escape the browser sandbox using a crafted HTML page. Because it breaks the sandbox boundary, it turns a renderer compromise into a full host compromise, which is why it was added to CISA KEV.
Impact
An attacker with renderer code execution gains the ability to escape Chrome's sandbox and run code at the browser's privilege level on the host, potentially leading to full system compromise.
Attack surface
Reached remotely over the network via a crafted HTML page; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), and the description states the attacker must already have compromised the renderer process.
Exploitation
Listed in CISA KEV with a 2023-05-12 remediation due date, indicating known exploitation; EPSS 30-day probability is 0.05739 (92.7th percentile), and no ransomware campaign use is documented.
What to do
- Update Google Chrome to 112.0.5615.137 or later, and apply the corresponding Debian (DSA-5393) and Fedora updates for bundled Chromium.
- Enforce automatic browser updates and verify deployed versions across endpoints.
- Restrict or isolate high-risk browsing and block untrusted HTML content where feasible.
- Track the CISA KEV due date (2023-05-12) and confirm remediation before it lapses.
Detection
- Monitor for Chrome processes spawning unexpected child processes, which can indicate sandbox escape.
- Alert on exploitation attempts or crashes tied to Skia rendering of crafted HTML pages.
- Audit endpoint browser versions against the fixed 112.0.5615.137 baseline to find unpatched hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2023-2136 to the Known Exploited Vulnerabilities catalog on 21 April 2023 as "Google Chrome Skia Integer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 12 May 2023.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-2136 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-2136), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
