CVE-2023-6345: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A mathematical error in Chrome's graphics engine allowed attackers who gained control of the browser's renderer to break out of Chrome's security sandbox using a specially crafted file. This is critical because it lets attackers access your entire computer.
Integer overflow in Skia graphics library allows sandbox escape when renderer process is compromised. Attack requires prior renderer compromise and malicious file delivery; successful exploitation grants system-level code execution beyond sandbox boundaries.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.