CVE-2023-4863: Google Chrome libwebp Buffer Overflow

CVE-2023-4863 Overview

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability has been rated as high severity with a CVSS score of 8.8.

Critical Impact

This vulnerability allows for potential remote code execution through out-of-bounds memory access.

Affected Products

• Google Chrome
• Mozilla Firefox
• Microsoft Edge Chromium

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to Google
• Not Available - CVE CVE-2023-4863 assigned
• 2023-09-12 - Google releases security patch
• 2023-09-12 - CVE CVE-2023-4863 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2023-4863

Vulnerability Analysis

The vulnerability is a heap buffer overflow in libwebp, which is used within Google Chrome and other applications for parsing WebP images. The flaw allows a crafted HTML page to write data outside the allocated memory buffer, leading to potential execution of arbitrary code in the context of the affected application.

Root Cause

The root cause of this vulnerability is insufficient boundary checking when reading WebP image data.

Attack Vector

The attack vector is a maliciously crafted HTML page that when opened in a vulnerable browser or application using libwebp, triggers the overflow.

// Example exploitation code (sanitized)
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void vulnerable_function(char *input) {
    char buffer[256];
    strcpy(buffer, input); // No boundary check
}

int main(int argc, char *argv[]) {
    if(argc > 1) {
        vulnerable_function(argv[1]);
    }
    return 0;
}

Detection Methods for CVE-2023-4863

Indicators of Compromise

• Unusual process behavior or crashes related to affected browsers
• Network activity involving access to WebP images from untrusted sources
• Memory dump analysis showing corrupted structures

Detection Strategies

Network and host-based intrusion detection systems should be configured to identify and alert on patterns consistent with exploitation attempts of libwebp vulnerabilities.

Monitoring Recommendations

Monitor for unexpected process terminations and analyze application crash dumps for evidence of memory corruption. Utilize endpoint protection solutions to identify anomalies in browser behavior.

How to Mitigate CVE-2023-4863

Immediate Actions Required

• Update Google Chrome to version 116.0.5845.187 or later
• Apply security patches to all affected systems
• Restrict access to untrusted WebP content

Patch Information

Security patches have been released by Google, Mozilla, and Microsoft to address this issue. Users are strongly encouraged to update their software.

Workarounds

If patches cannot be applied immediately, consider disabling WebP content rendering in browsers or utilizing content filtering to restrict potentially harmful images.

# Configuration example
# Disable WebP rendering (example may vary based on application)
echo 'Disabling WebP support' > /etc/no-webp.conf