CVE-2023-4860 is a flaw in Skia in Google Chrome before 115.0.5790.98 that could allow a sandbox escape after the renderer is compromised. NVD scores it critical (9.6), while Chromium rates it high. Update Chrome to 115.0.5790.98 or later, and update other Chromium based browsers.
What's affected
The NVD record says an inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page.
Severity differs by source. NVD scores it 9.6 and the record marks it critical, while the record text itself carries the Chromium security severity of High. The Chrome Releases post of 18 July 2023, which announced Chrome 115 to the stable channel, lists it among the high severity fixes. Use the Chromium rating for urgency, and note that the NVD publication date in the record, 16 July 2024, is later than the release.
The fixed version is 115.0.5790.98 on Linux and Mac and 115.0.5790.98 or 99 on Windows, per the Chrome release notes. Any later release includes the fix. Chromium based browsers ship the fix on their own schedule.
How to check if you're exposed
Open chrome://version in Chrome and read the version number. Anything below 115.0.5790.98 is affected, and in practice most browsers have long since moved well past that.
For a fleet, use your device management tool to report the Chrome version and flag outliers, including old installs on rarely used machines and virtual desktop images.
Check embedded Chromium too. Desktop apps built on Electron or similar frameworks bundle their own copy, and they update only when the app does.
Remember that the attack needs a second flaw first, since the attacker must already control the renderer.
What to do now
- Update Chrome to the current stable release on every desktop.
- Check other Chromium based browsers for their own update.
- Find applications that embed Chromium and ask the vendor for updates.
- Keep automatic browser updates on, and restrict users from disabling them.
- Rebuild old golden images that carry outdated browser versions.
Why it matters
The record lists CWE-303, which covers incorrect implementation of an authentication algorithm. Chromium itself describes the issue as an inappropriate implementation in Skia, the graphics library, so treat the CWE label as the NVD classification rather than a full description.
A sandbox escape matters because browsers rely on the sandbox to limit the damage of a renderer bug. Used alone it does little, but chained with a renderer flaw it can turn a bad page into control of the machine. The record does not state exploitation, and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the severity critical or high?
NVD lists 9.6, which is critical. Chromium rates the bug High. Both agree that updating to 115.0.5790.98 or later is the fix.
Sources
Last reviewed: 19 October 2026.
