Intel

CVE-2023-4863

libwebp: OOB write in BuildHuffmanTable

criticalKEV: actively exploitedPoCEPSS 100%

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Source: OSVCISA_KEVOSVNVDCVEORGOSVOSVOSVCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2023-4863 carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R) and an EPSS score at the 100th percentile, meaning virtually every organisation running unpatched browsers or Electron-based applications is at meaningful risk. The attack requires only a single user interaction — visiting a page that loads a crafted WebP image — with no authentication or elevated complexity required. Critically, the vulnerability lives in the shared libwebp library, not just in Chrome, so the blast radius extends to Firefox, Safari, Android system components, and a wide range of desktop applications; organisations that patch only their browser fleet while leaving Electron apps and mobile devices unaddressed remain exposed. CISA has not flagged confirmed ransomware campaign use, but the combination of trivial exploitation, broad ecosystem reach, and a 100th-percentile EPSS score justifies treating this as a P1 patch event across all asset classes that embed libwebp.

Runbook · Step 1

Immediate response (0-24 h)

  • Patch Chrome/Chromium immediately: Update to version 116.0.5845.187 or later. Push via Google Update, Intune, or your enterprise software distribution tooling — confirm the exact target version in the vendor advisory.
  • Inventory libwebp across all applications: Identify every application embedding libwebp < 1.3.2 — Electron apps (VS Code, Slack, Signal, 1Password, Teams), Safari/WebKit-based browsers, and any ffmpeg or image-processing builds. Quick check: dpkg -l | grep webp (Debian/Ubuntu), rpm -qa | grep webp (RHEL/SUSE), brew list | grep webp (macOS).
  • Enforce Android patch compliance: Affected Android versions 11, 12, 12L, 13, and 14-next receive fixes via OEM updates or Google Play System Updates. Set MDM compliance policy to require minimum September 2023 security patch level; quarantine non-compliant devices from corporate network access.
  • Freeze unpatched Electron application deployments: Do not roll out new versions of Electron-based apps that bundle libwebp < 1.3.2 until patch status is confirmed. Verify bundled library version: strings <binary> | grep "libwebp" or ldd/otool -L.
  • Apply emergency browser policy: Where patching is delayed, use a forward proxy or Content-Security-Policy headers to restrict WebP delivery to managed endpoints (see Mitigation layers below).

Runbook · Step 2

Mitigation layers

  • Proxy/WAF — block or transcode WebP: Configure the egress proxy to block or convert Content-Type: image/webp responses until all endpoints are patched. Squid ACL: acl webp_block rep_mime_type image/webp + http_reply_access deny webp_block. Note: this breaks legitimate WebP content — treat as a break-glass measure only.
  • IPS signature: Deploy a Suricata or Snort rule targeting malformed VP8L Huffman table structures in WebP streams. Check the Emerging Threats ruleset for a published SID for CVE-2023-4863. As a fallback, flag WebP responses exceeding 16 MB as anomalous.
  • Endpoint hardening: Ensure browser sandbox flags are enforced — --no-sandbox must be prohibited in all launch configurations. On Windows, enable Exploit Protection (Windows Defender Exploit Guard) for chrome.exe and msedge.exe, specifically heap-spray protection and Export Address Filtering (EAF).
  • Least-privilege / process isolation: Run Electron apps and browser processes under restricted service accounts without local administrator rights. Use AppLocker or WDAC policies to prevent child-process spawning from browser renderer processes.
  • Network segmentation: Move internet-facing workstations running unpatched libwebp into a more restrictive VLAN until patching is complete. Developer workstations running Electron-based IDEs (VS Code, Cursor) are particularly high-risk and should be prioritised.

Runbook · Step 3

Detection rules

  • Sysmon EID 1 / EDR process tree: Child processes of chrome.exe, msedge.exe, electron.exe, or slack.exe spawning cmd.exe, powershell.exe, wscript.exe, or unknown binaries. Sigma shape: ParentImage|endswith: '\chrome.exe' AND Image|endswith: '\cmd.exe'.
  • Windows EID 4688 / Linux auditd execve: Process creation originating from a browser renderer context. On Linux, add an auditd rule with key=webp_exploit on execve syscalls where ppid matches a known browser process.
  • Network telemetry (Zeek/Suricata): Outbound connections from a browser process to new external destinations immediately after loading a .webp resource. Zeek correlation: join http.log (uri endswith .webp) with conn.log (new destination, delta < 5 s).
  • EDR memory anomaly: Heap-spray indicators in the renderer process — high frequency of small allocations in a short window. Filter CrowdStrike or SentinelOne telemetry for MEM_WRITE events outside normal heap bounds within the browser process.
  • Proxy/access log — oversized WebP: Requests for .webp resources with unusually large response sizes or malformed RIFF headers. SPL: index=proxy uri="*.webp" bytes_out > 5000000 | stats count by src_ip, uri.

Metrics

Severity
critical
Priority score
233.97
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
100.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
100.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-07-07 11:45 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • android

    platform/external/webp11

  • android

    platform/external/webp11:0

  • android

    platform/external/webp12

  • android

    platform/external/webp12:0

  • android

    platform/external/webp12L

  • android

    platform/external/webp12L:0

  • android

    platform/external/webp13

  • android

    platform/external/webp13:0

  • android

    platform/external/webp14-next

  • android

    platform/external/webp14-next:0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Linked advisories

IDCVE-2023-4863
libwebp: OOB write in BuildHuffmanTable — CVE-2023-4863 | NEOSEC Intel