CVE-2023-6345

What is Skia?

Skia is Google's open-source 2D graphics rendering library used by Chrome, ChromeOS, Android, Flutter, and other products to render canvas operations, images, and UI elements. In Chrome, Skia executes within the renderer process — the sandboxed process that handles web page rendering and JavaScript execution. A vulnerability in Skia that allows memory corruption within the renderer process is typically exploitable as a sandbox escape primitive: if an attacker has already achieved renderer process code execution (often via a separate V8/JavaScript engine exploit), a Skia sandbox escape allows them to break out of Chrome's sandboxing and execute arbitrary code on the host OS with the Chrome process's privileges.

Overview

CVE-2023-6345 is a zero-day integer overflow vulnerability in Chrome's Skia graphics engine, exploited as a sandbox escape in the context of full Chrome compromise chains. Google released an emergency patch on November 28, 2023 (Chrome 119.0.6045.199/200) and CISA added it to KEV the same day. Integer overflow vulnerabilities in graphics rendering libraries are commonly used as the second stage of browser exploit chains — combined with a JavaScript engine exploit for initial renderer compromise, the Skia overflow enables the attacker to escape Chrome's sandbox and achieve OS-level code execution.

Affected Versions

Other products using Skia (Flutter, Electron) may also be affected — check vendor advisories.

Technical Details

CWE-190 (Integer Overflow). The Skia graphics engine contains an integer overflow in its canvas or bitmap handling code. When processing a specially crafted image or canvas operation, an arithmetic calculation produces an integer overflow — the result wraps to a small value when the actual value exceeds the integer's maximum. This causes Skia to under-allocate a memory buffer based on the overflowed (small) size, while writing data based on the actual (large) size — resulting in a heap buffer overflow that corrupts adjacent memory.

In Chrome's security model, this memory corruption occurs within the renderer sandbox. The Scope Changed (S:C) rating reflects the sandbox escape: the vulnerability crosses the security boundary between the renderer process (untrusted, sandboxed) and the host OS. A successful exploit chain typically combines:

1. A JavaScript/V8 engine exploit for initial renderer code execution
2. CVE-2023-6345 (Skia integer overflow) for sandbox escape to OS-level code execution

Discovery

Reported to Google by Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group (TAG). TAG researchers discovering and reporting Chrome zero-days typically means the vulnerability was being actively used against high-value targets — nation-state-backed threat actors (commercial spyware vendors, government hackers) primarily exploit browser sandbox escapes against journalists, activists, dissidents, and government officials.

Exploitation Context

Browser sandbox escapes discovered by Google TAG are characteristic of commercial spyware exploitation chains (Pegasus, Predator, Reign) and nation-state offensive cyber operations targeting high-value individuals. The Skia integer overflow serves as the second stage in a full chain that starts with renderer compromise via JavaScript exploitation. The Scope Changed rating and CVSS 9.6 reflect that exploitation achieves OS-level access — allowing the attacker to install persistent malware, access files, camera, and microphone, and bypass device security controls.

Remediation

1. Update Chrome to 119.0.6045.199 or later — Chrome typically updates automatically, but verify via Chrome → Help → About Google Chrome.
2. Restart Chrome after the update to ensure the new version is active (Chrome downloads updates in the background but requires restart to apply them).
3. Organizations using Chromium-based browsers (Edge, Brave, Opera) should check for their respective updates — Skia is shared and these browsers typically release Chromium security updates promptly.
4. For ChromeOS devices, ensure the Chrome OS update is applied via Settings → About ChromeOS → Check for updates.
5. Enable Chrome automatic updates in managed environments via policy to minimize the window between zero-day disclosure and patch deployment.