Security readout for executives and security teams
Plain-English summary
CVE-2023-2136 is a Chrome graphics-engine flaw that could help an attacker escape Chrome's sandbox after already compromising the renderer through a crafted web page. Because CISA lists it in KEV, treat it as exploited in the wild and prioritize browser fleet remediation.
Executive priority
Handle as urgent endpoint hygiene because KEV status means exploitation has been observed. The practical business priority is fast browser update enforcement, especially for managed desktops and users exposed to untrusted web content.
Technical view
The issue is an integer overflow in Skia affecting Google Chrome before 112.0.5615.137. The CVE describes a remote attacker with renderer-process compromise potentially escaping the sandbox via crafted HTML. CVSS 3.1 is 9.6 with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on endpoints running Chrome or Chromium-derived packages older than the fixed Chrome release. Linux distribution advisories from Debian, Fedora, and Gentoo indicate downstream package updates were relevant. Evidence here does not prove exposure for every Skia-using product.
Exploitation context
Active exploitation is supported by CISA KEV listing. Public details in this bundle describe the prerequisite as renderer compromise plus crafted HTML, not a standalone one-click full compromise. No exploit procedure or reliable public exploitation chain is provided in the supplied sources.
Researcher notes
The key technical constraint is the renderer-compromise prerequisite. Validation should focus on affected browser versions and downstream Chromium packages. The supplied evidence does not include root-cause detail, exploit primitives, or a complete affected-product matrix beyond Chrome and listed distribution advisories.
Mitigation direction
- Update Google Chrome to 112.0.5615.137 or later.
- Apply Debian, Fedora, or Gentoo Chromium package updates where applicable.
- Prioritize managed browser fleets and high-risk user groups first.
- Review vendor guidance for any Chromium-based products in your environment.
- Use browser auto-update enforcement to prevent version drift.
Validation and detection
- Inventory Chrome and Chromium versions across endpoints.
- Confirm no installed browser is older than 112.0.5615.137.
- Check Linux package manager records for relevant Chromium security updates.
- Verify browser auto-update policies are enabled and enforced.
- Monitor vulnerability tooling for CVE-2023-2136 detections.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-2136 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H2.86Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.htmlCVE reference
- https://crbug.com/1432603CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/CVE reference
- https://www.debian.org/security/2023/dsa-5393CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/CVE reference
- https://security.gentoo.org/glsa/202309-17CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2136CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.