Chrome Skia CVE-2023-6345: Exploited Sandbox Escape

What to do

1. Confirm Chrome and Edge are current via chrome://version or edge://version, and relaunch if an update is pending.
2. Remove fleet policies that pin or indefinitely defer browser updates.
3. Inventory Electron apps and their bundled Chromium version; replace or update any built on Chromium older than 119.0.6045.199 without a backport.
4. Ask kiosk, thin-client and appliance vendors which Chromium build their embedded browser ships, and retire unsupported products.
5. Keep your own Electron apps on a supported Electron major and ship updates regularly.

How to check if you are affected or compromised

• Check browser version history in your endpoint inventory: devices on Chrome before 119.0.6045.199 or Edge before 119.0.2151.97 in late November 2023 were exposed.
• Google published no indicators of compromise or attacker details as of Oct 23, 2026; version state is the main signal.
• For likely espionage targets, review EDR telemetry from November 2023 for browser processes spawning unexpected executables or new persistence.

What happened#

On November 28, 2023, Google shipped Chrome 119.0.6045.199 (.199/.200 on Windows) with seven security fixes. One of them, CVE-2023-6345, is an integer overflow in Skia, the 2D graphics library Chrome uses to draw web content. Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group reported it on November 24. Google said it was "aware that an exploit for CVE-2023-6345 exists in the wild." CISA added it to the Known Exploited Vulnerabilities catalog on November 30, with a federal deadline of December 21, 2023.

Google's Project Zero root-cause analysis explains it. Skia's GPU drawing code merges consecutive vertex-drawing operations and adds their vertex counts in a 32-bit integer without an overflow check. A too-small buffer is then allocated and overrun, a heap out-of-bounds write. The assertion that would have caught it is compiled out of release builds. The exploit reached Skia from an already compromised renderer, and Project Zero says this sandbox escape "would typically be chained with a renderer exploit before and an LPE exploit after." It used the same route into Skia as CVE-2023-2136, an earlier 2023 Skia zero-day in a different component. Google has not named the attacker or the targets.

Who is affected#

The CVE record covers Chrome before 119.0.6045.199. Downstream fixes landed in:

• Chrome for Android 119.0.6045.193 (Nov 28, 2023), which carries the desktop fixes.
• Microsoft Edge 119.0.2151.97 and Extended Stable 118.0.2088.122 (Nov 29, 2023).
• Electron 25.9.7, 26.6.2 and 27.1.3, all released November 30, 2023, plus Electron 28.0.0 and later.

CISA's entry says the flaw also affects ChromeOS, Android and Flutter. No Android OS bulletin entry or Flutter advisory names this CVE; their patch status was not disclosed as of Oct 23, 2026.

Do you really need to act?#

For most people, no. Chrome, Edge and ChromeOS update themselves, and the fix is almost three years old. NVD scores it CVSS 9.6. Alone, though, the bug requires an attacker who already controls a renderer process, so it was one link in a chain that also needed a renderer exploit and usually a kernel exploit.

The lasting exposure is software that bundles a frozen copy of Chromium. That means Electron apps that have shipped nothing since late 2023, kiosk and signage builds, embedded browsers in appliances, and Chromium forks that lag upstream. Unless rebuilt, these still render untrusted content with the vulnerable Skia code.

What to do now#

1. Check browsers: open chrome://version or edge://version. In fleets, report versions centrally and flag anything far behind current Stable.
2. Remove policies that pin Chrome or Edge to a version or defer updates indefinitely.
3. Inventory Electron apps. Running strings <app binary> | grep -m1 -oE "Chrome/[0-9.]+" on the main binary or Electron framework usually reveals the bundled Chromium. Treat anything older than 119.0.6045.199 as exposed unless it is on Electron 25.9.7, 26.6.2, 27.1.3 or later.
4. Ask vendors of kiosks, thin clients and appliances with embedded browsers which Chromium build they ship. Retire products that no longer get updates.

How to tell if you were hit#

Google published no indicators of compromise or target profile, so version history is the practical signal. A device browsing on Chrome or Edge older than the fixed builds in late November 2023 was exposed, though the attacks were targeted. For likely espionage targets of that period, review EDR telemetry for browser processes spawning unexpected executables or creating persistence, and escalate to forensics.

Timeline#

• Nov 24, 2023 — Google TAG reports the Skia integer overflow.
• Nov 28, 2023 — Chrome 119.0.6045.199/.200 and Chrome for Android 119.0.6045.193 ship the fix. Google confirms an in-the-wild exploit.
• Nov 29, 2023 — Microsoft ships the fix in Edge 119.0.2151.97 and Extended Stable 118.0.2088.122.
• Nov 30, 2023 — CISA adds CVE-2023-6345 to KEV. Electron releases 25.9.7, 26.6.2 and 27.1.3 with the backport.
• Dec 21, 2023 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2023-6345 · KEV 2023-11-30 · Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Nov 28, 2023) chromereleases.googleblog.com
2. Google Project Zero — CVE-2023-6345: Integer overflow in Skia MeshOp::onCombineIfPossible googleprojectzero.github.io
3. CVE record — CVE-2023-6345 cve.org
4. NVD — CVE-2023-6345 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2023-6345 cisa.gov
6. Google Chrome Releases — Chrome for Android Update (Nov 28, 2023) chromereleases.googleblog.com
7. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
8. Electron — Release v25.9.7 releases.electronjs.org
9. Electron — Release v26.6.2 releases.electronjs.org
10. Electron — Release v27.1.3 releases.electronjs.org

Coverage and analysis

1. The Hacker News — Zero-Day Alert: Google Chrome Under Active Attack thehackernews.com