CVE-2023-2136: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A flaw in Chrome's graphics library (Skia) allows an attacker who already controls the browser's rendering process to escape the security sandbox and gain full system access by using a specially crafted webpage.
Integer overflow vulnerability in Skia graphics renderer enables sandbox escape when renderer process is compromised; attacker crafts malicious HTML to trigger the overflow, potentially escalating privileges to system level. Requires prior renderer compromise but results in critical sandbox bypass.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.