CVE-2023-4863

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 116.0.5845.187 libwebp versions prior to 1.3.2

Description A heap buffer overflow exists in the libwebp library used for encoding and decoding images in WebP format. A remote attacker can perform an out-of-bounds memory write by inducing the library to process a maliciously crafted HTML page or WebP image. This memory corruption occurs during the image decoding process and can lead to an application crash or the execution of arbitrary code. The issue has been actively exploited in the wild, including as part of zero-click exploits. Due to the widespread integration of libwebp, the flaw affects millions of applications and billions of devices globally, including major browsers and communication apps.

Recommendations Update Google Chrome to version 116.0.5845.187 or later. Update libwebp to version 1.3.2 or later.