CVE-2023-2136

CRITICAL KEV

Google Chrome <112.0.5615.137 - Sandbox Escape

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-2136 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 21, 2023.

Description

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

References (11)

Core 11
Core References
Issue Tracking, Third Party Advisory
https://crbug.com/1432603

Scores

CVSS v3 9.6
EPSS 0.0044
EPSS Percentile 63.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2023-04-21
VulnCheck KEV 2023-04-12
InTheWild.io 2023-04-12
ENISA EUVD EUVD-2023-33656
CWE
CWE-190
Status published
Products (5)
debian/debian_linux 11.0
fedoraproject/fedora 36
fedoraproject/fedora 37
fedoraproject/fedora 38
google/chrome < 112.0.5615.137
Published Apr 19, 2023
KEV Added Apr 21, 2023
Tracked Since Feb 18, 2026