Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-12-21. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 versions affected across 4 products
We're looking at Skia exploits – here is an insight blog from 2023 with some extra context: https://zerodayengineering.com/insights/chrome-skia-cve-2023-6345.html v8 zero to exploit: https://zerodayengineering.com/research/slides/VXCON2024_Workshop.pdf
Post summary
The post references a Skia-related CVE and links to a blog and slides, but offers no concrete PoC, exploit details, or patch information.
Google Chrome Skia Vulnerability Analysis (CVE-2023-6345) https://zerodayengineering.com/insights/chrome-skia-cve-2023-6345.html
Post summary
The text contains only a title and a link to an analysis page for CVE-2023-6345, with no explicit details on PoC, exploitation, or patching.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| OS | debian | debian_linux | 12.0 | - | - |
| OS | fedoraproject | fedora | 37 | - | - |
| OS | fedoraproject | fedora | 38 | - | - |
| OS | fedoraproject | fedora | 39 | - | - |
| App | chrome | - | - | - | |
| App | microsoft | edge_chromium | - | - | - |