CVE-2023-2136

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.057 · 93 %ileDEEURUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV
Likely / severe?
5.74% (93rd) EPSS
CVSS 9.6 · critical
Is it mine?
19 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

added 2023-04-21remediate by 2023-05-12

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

Google Chrome Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

01

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 6
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 6
v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190USprimaryCWE-190US
04

ATT&CK techniques

ATT&CK techniques this enables or maps to.

05

affected products (19)

Products and version ranges known to be affected.

06

advisories (4)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-1000Google Chrome und Microsoft Edge: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2023-04-18csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome und Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen.

  • WID-SEC-W-2023-1669Android Patchday Juli 2023Deutsch2023-07-05csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, seine Privilegien zu erweitern, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

  • WID-SEC-W-2023-1672Samsung Android: Mehrere SchwachstellenDeutsch2023-07-05csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, seine Privilegien zu erweitern, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

  • ASB-A-2781130332023-07-01vendor · osvUS

    In multiple functions of SkSLFunctionDefinition.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation.

07

also known as (5)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdNVDCVE.orgMITRE
published 2023-04-19modified 2026-07-23
10

references (36)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan