Integer Overflow in Google Chromium Skia (CVE-2023-6345) Enables Sandbox Escape
What It Is — Skia, the graphics library used by Google Chrome, ChromeOS, Android, and Flutter, contains an integer overflow that can be triggered by a crafted file. The flaw allows a remote attacker who has compromised the renderer process to potentially escape the browser sandbox.
Exploitability — The vulnerability is publicly disclosed (CVE‑2023‑6345) with a CVSS v3.1 base score of 8.8 (High). Proof‑of‑concept code has been observed in the wild, indicating active exploitation risk.
Affected Products — Google Chrome, ChromeOS, Android, Flutter, and any other product embedding the Skia library.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of third‑party components and timely patch deployment.
- Provides a concrete audit point for the control objective “Vulnerability Management – timely remediation and evidence.”
- Highlights that a defensible evidence trail (SBOM updates, patch logs) is increasingly demanded by enterprise buyers during security reviews.
Recommended Actions
- Deploy the latest patches from Google that address CVE‑2023‑6345 across all affected platforms.
- Update your software‑bill‑of‑materials (SBOM) to reflect the patched Skia version.
- Record remediation steps in your vulnerability‑management system to generate audit‑ready evidence of control compliance.
Source: CISA KEV – CVE‑2023‑6345