Skip to main content
Apexward Pulse

Google · Memory corruption

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

CVE-2023-4863

What this means

This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Google Chrome, Fedoraproject Fedora and Debian Debian Linux, and 9 more are in your estate, and treat that as the priority.

Full vendor description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Scoring and exploitation

8.8/ 10
CVSS 3.1 base scoreHigh

Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~100% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Google Chromium WebP

Weaknesses

CWE-787

Affected products ()

  • Google Chrome
  • Fedoraproject Fedora
  • Debian Debian Linux
  • Mozilla Firefox
  • Mozilla Thunderbird
  • Microsoft Edge Chromium
  • Microsoft Teams
  • Microsoft Webp Image Extension
  • Webmproject Libwebp
  • Netapp Active Iq Unified Manager
  • Bentley Seequent Leapfrog
  • Bandisoft Honeyview
Show the raw CPE strings (18)
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:*
  • cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*
  • cpe:2.3:a:microsoft:webp_image_extension:*:*:*:*:*:*:*:*
  • cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*
  • cpe:2.3:a:bandisoft:honeyview:*:*:*:*:*:*:*:*

References

20 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

    Type Vulnerability

    A vulnerability in Google Chromium's WebP component could allow attackers to execute arbitrary code, bypass authentication, or cause system denial-of-service conditions.

    Next step: Confirm whether Google Chrome is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    Google ChromeMozilla FirefoxMozilla Thunderbird+2 moreAdvanced ManufacturingSaaS
    CVE-2023-4863+3