NVD - CVE-2023-4863
nvd.nist.gov

Any Chromium and Firefox browser prior to version 116 will be vulnerable to this, update your browsers.

    • Bipta
      15•1 year ago

      As far as I’m aware this does affect Android and is not currently fixed. It’s expected to be fixed in the October security patch.

      This is just my memory of reading weeks ago. Someone else may know better.

      • @9point6English
        9•1 year ago

        The Android webview is updated through the play store as of a few years ago

        • Bipta
          4•1 year ago

          I believe the libwebp is implemented at the OS level. Again someone else may know better.

      • @TakingOnWaterEnglish
        1•1 year ago

        So if the phone gets a security update for this at the OS level, should we theoretically be safe to use apps with any sort of browser functionality? Like some apps that don’t update, or are no longer being maintained, etc

    • @GamingChairModelEnglish
      5•1 year ago

      This isn’t just a browser vulnerability. It’s a vulnerability at a much more fundamental level, which is why it’s so critical. It’s a vulnerability in how almost every piece of software processes a widely supported image format, so anything that touches images is potentially at risk: browsers, chat or messaging apps, file browsers, or really anything that uses thumbnails or image previews, including some core OS functionality. On the server side, you’ve got anything that makes thumbnails and previews, too.

      We should wait and see whether there are any practical attacks outside the browser context (maybe the malicious code needs to be placed in a web page that displays the malicious image file, or maybe they need to figure out a way to actually put all the malicious code in the image file itself). But the vulnerability itself is in a fundamental library used by a lot more software.