THE WEBP 0DAY

Summary from the TLDR Web Dev newsletter

Google released a new stable update for Chrome early last week. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, involved a heap buffer overflow in the WebP image library. The Google team acknowledged that an exploit for it still exists. This post attempts to explain what is known about the unusual circumstances of this bug. It provides a new technical analysis and proof-of-concept trigger for CVE-2023-4863.