CVE-2023-6345: Google Skia Integer Overflow Vulnerability

CVE-2023-6345 is an integer overflow vulnerability in Google Chromium's Skia graphics component. An attacker who has already compromised the renderer process can use a malicious file to potentially escape the sandbox. The issue affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products that incorporate Skia. It matters because a successful escape can expand limited renderer access into broader control of the browser or host environment, increasing the impact of an initial compromise.

Defenders should treat this as a high-priority browser and platform risk. Confirm exact affected builds, fixed versions, and deployment guidance against the vendor advisory, as public detail beyond the CISA summary is limited.

How it works

The underlying weakness is CWE-190 (Integer Overflow or Wraparound). In graphics libraries such as Skia, integer values often control buffer sizes, coordinates, or allocation lengths. An overflow can produce an incorrect (usually smaller) value that is later used for memory operations. When the renderer process is already under attacker control, a crafted malicious file can trigger the overflow during rendering or image processing. The resulting memory corruption may allow code or data to cross the sandbox boundary that normally isolates the renderer from the rest of the browser and operating system.

No public exploit mechanics or proof-of-concept details are provided in the available facts; treat any claimed exploit steps as unverified until confirmed by the vendor or trusted analysis. The attack chain requires prior renderer compromise, so the vulnerability is typically chained with other renderer bugs rather than used as a pure remote code execution vector by itself.

Am I affected? How to find it in your systems

Skia is embedded in Chromium-based browsers and several Google platforms. Inventory systems that run Google Chrome, ChromeOS devices, Android handsets and tablets, and applications built with Flutter. Also check any third-party products that ship Chromium or Skia (for example, certain Electron apps or custom Chromium forks). On managed endpoints use software inventory tools, package managers, or MDM queries to list browser and OS versions. On Android, review system image and WebView versions. For Flutter, identify apps that embed the engine and note the engine or Skia revision if available.

Compare discovered versions against the fixed releases listed in the official vendor advisory; do not rely on version numbers from secondary sources. Configuration-wise, any installation that processes untrusted files or web content through Skia is potentially exposed once the renderer is compromised.

Telemetry signs of exploitation are limited because the vulnerability is a sandbox escape after renderer compromise. Look for unexpected renderer crashes, anomalous process trees originating from the browser sandbox, or sudden privilege escalations associated with Chrome or Android system processes. Correlate with prior indicators of renderer compromise (for example, drive-by downloads or malicious documents). Enable browser and OS crash reporting and review sandbox violation logs where available.

How to remediate

Patch first. Apply the vendor-supplied updates for Chrome, ChromeOS, Android, Flutter, and any other affected products exactly as directed in the official advisory. CISA's required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. After updating, verify the installed version matches the fixed release and restart browsers and devices so the new Skia code is loaded.

For this class of integer-overflow and sandbox-escape issues, additional hardening includes keeping all Chromium-based components on a rapid update cadence, restricting the ability of untrusted users to open arbitrary files in the browser, and enabling available site isolation and sandbox features. Where Flutter or custom Skia builds are used, rebuild and redeploy with the patched library. Confirm all steps against the vendor advisory before declaring systems remediated.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls. Segment high-risk browsers and ChromeOS devices onto restricted network segments that limit lateral movement. Disable or restrict file-handling features that feed untrusted content into the renderer if the product allows it. Deploy virtual patching or content-filtering rules that block known malicious file types and suspicious download patterns, understanding that these are imperfect for a post-renderer sandbox escape. Increase monitoring of renderer processes, sandbox violations, and unusual child processes spawned by the browser. On Android, limit sideloading and enforce verified boot and app sandboxing. If mitigations are unavailable for a given product, plan to discontinue its use for high-risk activities until a patch is available, consistent with CISA guidance.

If your data may have been exposed

Actively exploited sandbox-escape vulnerabilities can lead to full browser or device compromise and subsequent data theft. Known ransomware use of this CVE is not documented. If you suspect compromise, isolate affected systems, collect forensic artifacts, and follow your incident-response plan. As a quick check for previously leaked credentials, you can run a free exposure scan of your email addresses against known breach data.