A Chrome Bug That Was Never Just a Chrome Bug
When Google disclosed a heap buffer overflow in WebP on September 12, 2023, the initial advisory pointed at Chrome. The reality was broader: the flaw lived in libwebp, the library nearly every WebP-handling application relies on. What looked like a browser-specific issue was actually a defect in a codebase shared across browsers, email clients, chat apps, graphics tools, and operating systems.
A Vulnerability With Two Faces
The issue, tracked as CVE-2023-4863, allows an attacker to craft a malformed WebP file that makes libwebp write past the bounds of its allocated memory buffer. By corrupting adjacent heap data, the attacker can manipulate application behavior and ultimately execute arbitrary code.
The story did not start with Google. In early September, Citizen Lab reported an exploit targeting an iPhone belonging to a Washington DC-based civil society organization. Apple's advisory for that incident, CVE-2023-41064, described a "buffer overflow issue in ImageIO" without connecting it to WebP. Only after Google published its Chrome advisory did it become clear that both CVEs pointed to the same underlying flaw in libwebp.
How the Flaw Worked
WebP combines two formats: a lossy mode based on the VP8 codec and a lossless mode using WebP's own codec. The bug was in the lossless decoder's handling of Huffman coding.
Huffman coding assigns shorter bit sequences to frequently occurring values and longer sequences to rarer ones, building a binary tree of codes. For speed, decoders do not traverse the tree bit by bit. Instead, they construct lookup tables that match multiple bits at once.
The WebP file contains a compressed description of the Huffman tree shape. The decoder reconstructs that tree and uses it to build the lookup tables. Libwebp's flaw sat in that table-building code. A specially crafted file could specify an extremely unbalanced tree with codes far longer than any legitimate WebP would contain. The table-building function wrote past its allocated buffer before running its validity checks.
That buffer lives on the heap, where application data resides. Overwriting adjacent memory lets an attacker corrupt sensitive state and, with enough control, redirect execution to attacker-supplied code.
The fix in libwebp made two changes: it validates input data more strictly and allocates memory dynamically only after confirming the internal structure is valid, ensuring the buffer is always large enough.
The library is mature and maintained by experienced developers, but it is written in C, a language with few safeguards around memory errors. One incorrect assumption about input data was enough to create a critical vulnerability.
Responding Before the Patch Was Public
Google's advisory did not come with a patched libwebp release. The fix existed in the project's repository but had not been officially published. After filing an internal security ticket the same day as Google's announcement, Cloudflare engineers found the unreleased patch, applied it to their services, and updated libwebp a day before the official release.
Cloudflare's image processing services are written in Rust. The team submitted patches to Rust packages that bundled copies of libwebp and filed the corresponding RustSec advisories, RUSTSEC-2023-0061 and RUSTSEC-2023-0062, to alert the wider Rust ecosystem.
GitHub's vulnerability scanner picked up those RustSec reports as the first public signal of CVE-2023-4863, before the issue was widely known. That early detection underlined the value of structured disclosure channels in the open-source community.
Cloudflare found no evidence that the vulnerability was ever used against its infrastructure. The exploit appears to have targeted specific individuals, not large service providers. Still, the company updated its services before the flaw became public knowledge, following its policy of limiting edge binaries to signed, internally vetted code.
One CVE, Eventually Two, Then One Again
Google later broadened its description of the issue to cover all uses of WebP, initially filing that wider advisory as a new CVE, CVE-2023-5129. That entry was subsequently flagged as a duplicate of CVE-2023-4863, and the original description was updated to reflect the full scope of affected software.
The incident is a reminder that a vulnerability's initial framing can conceal its true reach. A bug described as a Chrome issue turned out to affect nearly every platform that decodes WebP images. The lesson for users is straightforward: keep browsers, applications, and operating systems updated, and apply security patches promptly. For software maintainers, it reinforces the importance of coordinated disclosure and rapid collaboration across the ecosystem.
