Coverage › CVE-2023-2136

CVE-2023-2136 Mapped Sigma

Google Chrome Skia Integer Overflow Vulnerability

Vendor / product: Google — Chromium Skia
Description (CISA): Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Added to KEV: 2023-04-21
Due date: 2023-05-12
Required action: Apply updates per vendor instructions.
Known ransomware use: Unknown
CWE: CWE-190
CISA notes: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html
https://nvd.nist.gov/vuln/detail/CVE-2023-2136
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1204.001 Malicious Link	exploitation technique	This integer overflow vulnerability is exploited by a remote attacker who has already compromised the renderer process of Google Chrome. Exploiting this vulnerability might lead to incorrect rendering, memory corruption, and arbitrary code execution that could grant the adversary unauthorized access to the system. Exploitation in the wild techniques have not been publicly released to reduce further abuse. ref 1 · ref 2	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1204.001 Malicious Link exploitation technique

DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
AN0178 Windows
Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
NSM:Flow Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST → DC0085 Network Traffic Content

Tunable: TimeWindow BrowserParents UserPaths SuspiciousTLDs AllowedCDNs

AN0179 Linux
Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.

auditd:SYSCALL execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline → DC0082 Network Connection Creation
auditd:SYSCALL open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions → DC0039 File Creation
NSM:Flow Suspicious URL patterns, uncommon TLDs, URL shorteners → DC0085 Network Traffic Content

Tunable: TimeWindow UserPaths HighRiskExtensions DomainRiskScore

AN0180 macOS
Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.

macos:unifiedlog open URL|clicked link|LSQuarantineAttach → DC0085 Network Traffic Content
NSM:Connections New outbound connection from Safari/Chrome/Firefox/Word → DC0082 Network Connection Creation
fs:fsevents Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute → DC0039 File Creation

Tunable: TimeWindow QuarantinePolicy SuspiciousTLDs

Sigma rules tagged `attack.t1204.001` (4)

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Symlink Etc Passwd hightest

Author: Florian Roth (Nextron Systems) · 2019-04-05 (modified 2021-11-27) · logsource: product=linux · c67fc22a-0be5-4b4f-aad5-2b32c4b69523

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Techniques: T1204.001

Suspicious ClickFix/FileFix Execution Pattern highexperimental

Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

Techniques: T1204.001 T1204.004

Potential ClickFix Execution Pattern - Registry highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-03-25 (modified 2025-11-19) · logsource: product=windows category=registry_set · f5fe36cf-f1ec-4c23-903d-09a3110f6bbb

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.