CVE-2024-8193
published 2024-08-28CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.59%
48.1th percentile
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 128.0.6613.113-1~deb12u1 | 128.0.6613.113-1~deb12u1 |
| chromium | chromium | >= 0 < 128.0.6613.113-1 | 128.0.6613.113-1 |
| chromium | chromium | >= 0 < 128.0.6613.113-1 | 128.0.6613.113-1 |
| debian | chromium | < chromium 128.0.6613.113-1~deb12u1 (bookworm) | chromium 128.0.6613.113-1~deb12u1 (bookworm) |
| chrome | < 128.0.6613.113 | 128.0.6613.113 | |
| chrome | >= 128.0.6613.113 < 128.0.6613.113 | 128.0.6613.113 | |
| chrome_chrome | — | — | |
| paloalto | prisma_browser | — | — |
| webkitgtk | webkitgtk | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2024-8193
vendor_chrome·2024-09-23·CVSS 8.8
CVE-2024-8193 [HIGH] Long Term Support Channel Update for ChromeOS: CVE-2024-8193
Long Term Support Channel Update for ChromeOS
CVE-2024-8193
Palo Alto
PAN-SA-2024-0009 Prisma Browser: Monthly Vulnerability Updates
vendor_paloalto·2024-09-11·CVSS 8.8
[HIGH] PAN-SA-2024-0009 Prisma Browser: Monthly Vulnerability Updates
PAN-SA-2024-0009 Prisma Browser: Monthly Vulnerability Updates
Prisma Browser has incorporated the latest upstream Chromium security fixes listed here: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html CVE CVSS Summary CVE-2024-7964 8.8 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H ) Fixed in Prisma Browser 128.91.2869.7 - Chromium: Use after free in Passwords. CVE-2024-7965 8.8 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H ) Fixed in Prisma Browser 128.91.2869.7 - Chromium: Inappropri
Red Hat
chromium: skia: chromium: skia: Heap buffer overflow in Skia
vendor_redhat·2024-08-28·CVSS 8.8
CVE-2024-8193 [HIGH] CWE-122 chromium: skia: chromium: skia: Heap buffer overflow in Skia
chromium: skia: chromium: skia: Heap buffer overflow in Skia
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Affected
Package: webkitgtk4 (Red Hat Enterprise Linux 7) - Affected
Package: webkit2gtk3 (Red Hat Enterprise Linux 8) - Affected
Package: webkit2gtk3 (Red Hat Enterprise Linux 9) - Affected
Debian
CVE-2024-8193: chromium - Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a ...
vendor_debian·2024·CVSS 8.8
CVE-2024-8193 [HIGH] CVE-2024-8193: chromium - Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a ...
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Scope: local
bookworm: resolved (fixed in 128.0.6613.113-1~deb12u1)
bullseye: open
forky: resolved (fixed in 128.0.6613.113-1)
sid: resolved (fixed in 128.0.6613.113-1)
trixie: resolved (fixed in 128.0.6613.113-1)
VulDB
Google Chrome up to 128.0.6613.84 Skia heap-based overflow (WID-SEC-2026-3625)
vuldb·2026-09-30·CVSS 8.8
CVE-2024-8193 [HIGH] Google Chrome up to 128.0.6613.84 Skia heap-based overflow (WID-SEC-2026-3625)
A vulnerability labeled as critical has been found in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Skia. Executing a manipulation can lead to heap-based buffer overflow.
The identification of this vulnerability is CVE-2024-8193. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
GHSA-5q6v-fp9h-6rjg: Heap buffer overflow in Skia in Google Chrome prior to 128
ghsa_unreviewed·2024-08-29
CVE-2024-8193 [HIGH] CWE-122 GHSA-5q6v-fp9h-6rjg: Heap buffer overflow in Skia in Google Chrome prior to 128
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
OSV
CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome prior to 128
osv·2024-08-28·CVSS 8.8
CVE-2024-8193 [HIGH] CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome prior to 128
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-8193 webkitgtk: chromium: skia: Heap buffer overflow in Skia [fedora-all]
bugzilla·2026-09-21·CVSS 8.8
CVE-2024-8193 [HIGH] CVE-2024-8193 webkitgtk: chromium: skia: Heap buffer overflow in Skia [fedora-all]
CVE-2024-8193 webkitgtk: chromium: skia: Heap buffer overflow in Skia [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Discussion:
FEDORA-2026-b3f7d5344b (webkitgtk-2.54.0-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b3f7d5344b
---
FEDORA-2026-164300cb22 (webkitgtk-2.54.0-1.fc44) has been submitted as an upd
Bugzilla
CVE-2024-8193 webkitgtk: chromium: skia: Heap buffer overflow in Skia [epel-all]
bugzilla·2026-09-21·CVSS 8.8
CVE-2024-8193 [HIGH] CVE-2024-8193 webkitgtk: chromium: skia: Heap buffer overflow in Skia [epel-all]
CVE-2024-8193 webkitgtk: chromium: skia: Heap buffer overflow in Skia [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2024-8193 chromium: skia: chromium: skia: Heap buffer overflow in Skia
bugzilla·2024-08-28·CVSS 8.8
CVE-2024-8193 [HIGH] CVE-2024-8193 chromium: skia: chromium: skia: Heap buffer overflow in Skia
CVE-2024-8193 chromium: skia: chromium: skia: Heap buffer overflow in Skia
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
2024-08-28
Published