Google · Chromium WebP
The Chromium WebP component (libwebp, as shipped in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2) contains a heap-based buffer overflow that leads to an out-of-bounds memory write. An remote attacker can trigger it by getting a user to load a crafted HTML page, requiring no authentication, only user interaction.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
First seen exploited 6 days before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 9 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Drive-by via malicious web page
via a crafted HTML page
Memory corruption yields code execution
perform an out of bounds memory write
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
13 packages in 5 ecosystems. Main package: webp.
Upgrade to 0.2.6 or later
cargo update -p webp --precise 0.2.6The first fix for CVE-2023-4863. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 0.2.6 | 0.2.6 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.