UPDATE YOUR BROWSERS IMMEDIATELY. RCE VULNERABILITY DISCOVERED

Further solidifying webp as the worst image format.

It's the full disclosure of the ImageIO webp vuln from last week, this is the root cause.

Specifically 117.0.1 (117.1 on android)

It's last week's big libwebp vulnerability again.

Edit: this underlying vuln is why last week's CVE was such a big deal, anything using webp is at risk including a whole big pile of electron apps that everyone uses.

Sorta. OP just linked the full disclosure of the libwebp vulnerability that made the news 2 weeks ago.

But there's an even more recent vulnerability in libvpx that was announced this week, that is similar in a lot of ways (including severity).

I've read elsewhere it's actually a problem with libwebp not just chrome.
Basically, anything that relies on libwebp (ie can play libwebp) is vulnerable.
https://snyk.io/blog/critical-webp-0-day-cve-2023-4863/

Current Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Discord, slack, MS Teams, Steam, pretty much anything. But most of them have already fixed it so if you let stuff update itself frequently, there's little risk.

Apple also released urgent out-of-band security patches for iOS and MacOS around the same time, and disclosed that it had something to o do with imag processing. Unclear whether they use libwebp or some other implementation, but they disclosed that it was being actively exploited on iPhones.

Yeah, Linux boys would be mad

Imma let you get to that soon but we all know RCE vulnerabillities really won the night here

As far as I'm aware this does affect Android and is not currently fixed. It's expected to be fixed in the October security patch.

This is just my memory of reading weeks ago. Someone else may know better.

This isn't just a browser vulnerability. It's a vulnerability at a much more fundamental level, which is why it's so critical. It's a vulnerability in how almost every piece of software processes a widely supported image format, so anything that touches images is potentially at risk: browsers, chat or messaging apps, file browsers, or really anything that uses thumbnails or image previews, including some core OS functionality. On the server side, you've got anything that makes thumbnails and previews, too.

We should wait and see whether there are any practical attacks outside the browser context (maybe the malicious code needs to be placed in a web page that displays the malicious image file, or maybe they need to figure out a way to actually put all the malicious code in the image file itself). But the vulnerability itself is in a fundamental library used by a lot more software.

It's anything implementing .webp support. Though the CVE has been out for nearly two weeks already so most apps have been patched.

Yes but this is a vulnerability now open to the public that script kiddies are going to utilize so unless you want your data grabbed by a 14yo larper for opening an image in your browser update your browser

How is this clickbait? The all-caps is a bit much, but the title contains everything you need to know. There's nothing remotely clickbaity about it.