CVE-2023-6345

A Google Skia integer overflow vulnerability allowed sandbox escape via a malicious file, actively exploited in the wild and impacting Chrome, ChromeOS, Android, and Flutter products.

An integer overflow in Google Skia enabled a renderer process compromise to potentially escape the sandbox, impacting numerous Google products and potentially derivatives. DIB organizations using these products or their components must immediately patch to prevent potential data exfiltration or system compromise, impacting NIST 800-171 controls related to data protection and vulnerability management.

Shame score — The vulnerability's active exploitation and broad impact across critical Google products demonstrates a significant failure in secure coding practices and risk management.