CVE-2023-2136

What is Google Chrome's Skia?

Google Chrome is the world's most widely used web browser, running on hundreds of millions of desktops and devices. Chrome's multi-process architecture uses a sandbox to isolate the renderer process (which handles web content parsing and rendering) from the OS and other processes. Skia is the open-source 2D graphics library used by Chrome, Android, Flutter, and ChromeOS to render text, images, and geometric shapes. Vulnerabilities in Skia are particularly impactful because Skia processes attacker-controlled web content (images, CSS, canvas operations) and runs inside the Chrome renderer process — making it an attractive target for sandbox escape exploits that leverage a renderer compromise to execute code on the underlying OS.

Overview

CVE-2023-2136 is a zero-day integer overflow vulnerability in the Skia graphics library that enables a renderer-to-OS sandbox escape in Google Chrome. An attacker who has already achieved renderer process compromise (e.g., through a separate renderer bug) can exploit this integer overflow in Skia to escape the Chrome sandbox and execute code at the OS level. Google patched it on April 18, 2023 in Chrome 112.0.5615.137/138, confirming that the vulnerability was being exploited in the wild at the time of the patch. The Scope Changed (S:C) rating reflects the sandbox escape — impact crosses the boundary from the renderer process into the broader OS.

Affected Versions

Other Skia-based products (Flutter, Android graphics stack) may also be affected by the underlying Skia bug.

Technical Details

CWE-190 (Integer Overflow or Wraparound). Skia performs mathematical calculations on dimensions and coordinates for rendering operations. An integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value for the data type, causing the value to wrap around to an unexpected small number. In Skia's rendering pipeline, an integer overflow in a bounds calculation or allocation size can cause the renderer to write graphics data outside the intended buffer bounds — a type confusion or out-of-bounds write exploitable for code execution.

The Scope Changed (S:C) CVSS rating captures the multi-step exploitation pattern: this vulnerability alone enables sandbox escape when chained with a renderer compromise. In practice, attackers chain a renderer vulnerability (to gain code execution inside the sandboxed renderer process) with a sandbox escape like CVE-2023-2136 (to escape the sandbox and reach the OS). CVE-2023-2136 is the second stage of such a chain.

Chrome's zero-day response cycle for in-the-wild exploitation is typically very fast — patches usually release within days of internal detection, and the KEV addition followed within three days of the patch.

Discovery

Reported to Google's Chrome security team. The zero-day status (in-the-wild exploitation at patch time) indicates the vulnerability was identified following active exploitation reports rather than through Google's internal fuzzing alone.

Exploitation Context

Skia integer overflow zero-days in Chrome are consistently exploited by commercial spyware vendors and sophisticated nation-state actors to achieve full OS-level code execution on target devices. The April 2023 Skia vulnerability follows a pattern of Skia-targeted exploitation that continued through 2023 — a later related Skia zero-day (CVE-2023-6345, also in KEV) was patched in November 2023. The S:C sandbox escape capability makes Skia zero-days extremely valuable in attack chains targeting journalists, dissidents, government officials, and enterprise executives.

User Interaction: Required reflects the need for the victim to visit a malicious webpage or open a malicious document in a Chromium-based browser, but this is a low bar — a single phishing link or drive-by redirect suffices.

Remediation

1. Update Google Chrome to version 112.0.5615.137 or later immediately via Chrome's built-in updater (Menu → Help → About Google Chrome).
2. Restart Chrome after updating to activate the patch — the update is not effective until Chrome relaunches.
3. Apply updates to other Chromium-based browsers (Microsoft Edge, Brave, etc.) which share the Skia library.
4. Apply ChromeOS system updates if running ChromeOS or ChromeOS Flex.
5. For enterprise environments: use Chrome's Extended Stable channel and configure forced auto-update policies to minimize the window between patch availability and deployment.
6. Consider enabling Chrome's Enhanced Safe Browsing for additional protection against drive-by exploitation delivery mechanisms.