1. Home
  2. Vulnerabilities
  3. CVE-2023-2136
Known Exploited Vulnerability
9.6
CRITICAL CVSS 3.1
CVE-2023-2136
Google Chrome Skia Integer Overflow Vulnerability - [Actively Exploited]
Description

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

INFO

Published Date :

April 19, 2023, 4:15 a.m.

Last Modified :

Oct. 24, 2025, 2:07 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

Required Action :

Apply updates per vendor instructions.

Notes :

https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html; https://nvd.nist.gov/vuln/detail/CVE-2023-2136

Affected Products

The following products are affected by CVE-2023-2136 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Fedoraproject fedora
1 Debian debian_linux
1 Google chrome
1 Microsoft edge_chromium
: Total Affected Vendor : 4 | Products : 4
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
CVSS 3.1 CRITICAL 134c704f-9b21-4f2e-91b3-4a467353bcc0
Solution
A vulnerability in Google Chrome allows for potential sandbox escape; updating the browser and related packages is recommended.
  • Upgrade to Google Chrome version 112.0.5615.137 or later.
  • Update the affected packages.
Public PoC/Exploit Available at Github

CVE-2023-2136 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-2136.

URL Resource
https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html Release Notes Vendor Advisory
https://crbug.com/1432603 Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ Mailing List
https://security.gentoo.org/glsa/202309-17 Third Party Advisory
https://www.debian.org/security/2023/dsa-5393 Third Party Advisory
https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html Release Notes Vendor Advisory
https://crbug.com/1432603 Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ Mailing List
https://security.gentoo.org/glsa/202309-17 Third Party Advisory
https://www.debian.org/security/2023/dsa-5393 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136 US Government Resource
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-2136 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-2136 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
wh1ant/vulnjs

Research browsers

Updated: 3 weeks, 6 days ago
44 stars 6 fork 6 watcher
Born at : March 10, 2025, 5:37 p.m. This repo has been linked 83 different CVEs too.
Profile Photo
gmh5225/vulnjs

Research browsers

JavaScript HTML

Updated: 9 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : March 10, 2025, 2:35 p.m. This repo has been linked 83 different CVEs too.
Profile Photo
RENANZG/My-Forensics

Digital Forensics and Incident Response (DFIR)

investigator babko backdoor honeypot criminal darknet forensics encrochat omerta interception government-hacking police-hacking rasterfahndung online-durchsuchungen technocolonialism zeroday-feature equipment-interference technical-capability-notice network-investigative-technique due-diligence

HTML Shell YARA

Updated: 11 months, 3 weeks ago
96 stars 14 fork 14 watcher
Born at : Aug. 21, 2023, 8:57 p.m. This repo has been linked 19 different CVEs too.
Profile Photo
RENANZG/My-Debian-GNU-Linux

Collection of Solutions for Debian GNU/Linux End Users

debian hardening security anticensorship freedom hashcheck secure-boot dkms shim encryption keyfile openssl sbsigntool mokutil sign-file grub postmodernism

Shell Python HTML Vim Script TeX CSS PowerShell Dockerfile JavaScript Makefile

Updated: 11 months ago
6 stars 0 fork 0 watcher
Born at : July 14, 2023, 1:06 a.m. This repo has been linked 16 different CVEs too.
Profile Photo
ayman-m/rosetta

Rosetta is a Python library that allows you to generate fake data of different formats such as Syslog, CEF, LEEF, Winevent and JSON. It also includes a Converter class that can convert between different log formats. Additionally, it provides a Sender class that sends generated data to a specified destination over TCP, UDP, or HTTP protocols.

Python Shell

Updated: 11 months, 2 weeks ago
2 stars 0 fork 0 watcher
Born at : April 8, 2023, 5:19 p.m. This repo has been linked 3 different CVEs too.
Profile Photo
Threekiii/CVE

一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.

Updated: 1 month ago
148 stars 21 fork 21 watcher
Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 203 different CVEs too.
Profile Photo
Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 months, 1 week ago
588 stars 42 fork 42 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1290 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-2136 vulnerability anywhere in the article.

  • Daily CyberSecurity
Prompt to Play: YouTube’s New Gemini 3 Tool Lets Creators Speak Games Into Existence

Google’s fixation on embedding AI across all of its services appears boundless. Following earlier experiments with the “Playables” mini-game feature on YouTube, YouTube Gaming has now announced an ope ... Read more

Published Date: Dec 17, 2025 (3 days, 4 hours ago)
  • CybersecurityNews
Predator Spyware Compamy Used 15 Zero-Days Since 2021 to Target iOS Users

A commercial spyware company called Intellexa has exploited 15 zero-day vulnerabilities since 2021 to target iOS and Android users worldwide. The company, known for developing the Predator spyware, co ... Read more

Published Date: Dec 08, 2025 (1 week, 5 days ago)
  • The Hacker News
Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery

A human rights lawyer from Pakistan's Balochistan province received a suspicious link on WhatsApp from an unknown number, marking the first time a civil society member in the country was targeted by I ... Read more

Published Date: Dec 05, 2025 (2 weeks, 1 day ago)
  • Google Cloud
Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue

Introduction Despite extensive scrutiny and public reporting, commercial surveillance vendors continue to operate unimpeded. A prominent name continues to surface in the world of mercenary spyware, In ... Read more

Published Date: Dec 03, 2025 (2 weeks, 2 days ago)
  • TheCyberThrone
CISA adds CISCO ISE and PaperCut MF flaws to KEV Catalog

Skip to content July 29, 2025The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 2 ... Read more

Published Date: Jul 29, 2025 (4 months, 3 weeks ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2023-2136 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Oct. 24, 2025

    Action Type Old Value New Value
    Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136 Types: US Government Resource
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 21, 2025

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 21, 2025

    Action Type Old Value New Value
    Removed Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 21, 2025

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136
  • Modified Analysis by [email protected]

    Feb. 19, 2025

    Action Type Old Value New Value
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jan. 28, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    Added CWE CWE-190
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html
    Added Reference https://crbug.com/1432603
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/
    Added Reference https://security.gentoo.org/glsa/202309-17
    Added Reference https://www.debian.org/security/2023/dsa-5393
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Modified Analysis by [email protected]

    Oct. 20, 2023

    Action Type Old Value New Value
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ Mailing List, Third Party Advisory https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ Mailing List
    Changed Reference Type https://security.gentoo.org/glsa/202309-17 No Types Assigned https://security.gentoo.org/glsa/202309-17 Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/202309-17 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 02, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 27, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Apr. 26, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    Changed Reference Type https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html No Types Assigned https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html Release Notes, Vendor Advisory
    Changed Reference Type https://crbug.com/1432603 No Types Assigned https://crbug.com/1432603 Issue Tracking, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ Mailing List, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ Mailing List
    Changed Reference Type https://www.debian.org/security/2023/dsa-5393 No Types Assigned https://www.debian.org/security/2023/dsa-5393 Third Party Advisory
    Added CWE NIST CWE-190
    Added CPE Configuration OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 112.0.5615.137
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Apr. 26, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 23, 2023

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2023/dsa-5393 [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 21, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 21, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 20, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.6
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.63 }} 0.09%

score

0.69493

percentile