Google Chrome and libwebp Heap Buffer Overflow Vulnerability (CVE-2023-4863)
Executive & SecOps Summary
SECOPS ASSESSMENTGoogle Chrome prior to 116.0.5845.187 and libwebp library prior to 1.3.2
A remote attacker can trigger an out-of-bounds memory write and potentially execute arbitrary code via a crafted HTML page containing a malicious WebP image
Immediately update Google Chrome to version 116.0.5845.187 or higher, and upgrade libwebp dependency to 1.3.2 or above
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the libwebp package on Debian/Ubuntu-based Linux systems to apply the security patch:
# Update package lists and upgrade libwebp libraries
sudo apt-get update && sudo apt-get --only-upgrade install -y libwebp-dev libwebp7
# Verify the installed version
dpkg -l | grep libwebp2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible on web servers, you can temporarily block or restrict WebP uploads at the reverse proxy level using Nginx:
# Block WebP uploads or processing in Nginx configuration
location ~* \.(webp)$ {
# Deny access or return a forbidden status to prevent server-side processing
return 403 'WebP processing is disabled.';
}3. Log Audit & IoC Verification Commands
Scan the system to locate all instances of libwebp shared objects and verify if any outdated versions are loaded:
# Locate all libwebp shared library files on the system
find / -name 'libwebp.so*' 2>/dev/null
# Check the version of libwebp linked in active processes
grep libwebp /proc/*/maps 2>/dev/null | awk '{print $6}' | sort -uScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-4863) is a critical heap buffer overflow (CWE-787) residing in libwebp, an open-source library developed by Google for rendering WebP images. The root cause lies in the Huffman table allocation logic during the decoding of lossless WebP images. An incorrect size calculation allows the decoder to write data beyond the allocated heap buffer boundaries.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by crafting a malicious WebP image with anomalous Huffman coding structures. When a victim visits a website hosting this image or uploads it to a server that processes images, the libwebp decoder attempts to parse the file. This triggers an out-of-bounds write, corrupting adjacent heap memory structures. Attackers can leverage this memory corruption to bypass browser sandboxes and achieve Remote Code Execution (RCE).
3. Infrastructure & Business Impact
Because libwebp is a foundational library, its impact extends far beyond Google Chrome. It is embedded in major operating systems, Electron-based applications (e.g., Slack, Teams, VS Code), and server-side image processing frameworks. Since this vulnerability has been actively exploited in the wild as a zero-day (confirmed by its CISA KEV status), unpatched systems face an imminent risk of endpoint compromise, data exfiltration, and lateral movement within corporate networks.
Official Vendor Advisories & References
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Frequently Asked SecOps Questions (CVE-2023-4863)
FAQQ1. How critical is CVE-2023-4863 and is it actively exploited in the wild?
CVE-2023-4863 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-4863?
Primary impacted vendors include google, webmproject across chrome, libwebp. Scope summary: Google Chrome versions prior to 116.0.5845.187 and libwebp versions prior to 1.3.2
Q3. What temporary mitigations or workarounds exist for CVE-2023-4863 before patching?
[Mitigation] Immediately update Google Chrome to version 116.0.5845.187 or higher, and upgrade libwebp dependency to 1.3.2 or above Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-4863
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (google)
View Category →Google Chrome Skia Graphics Engine Out-of-bounds Write Vulnerability (CVE-2026-3909) Technical Advisory
[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75
Google Chrome V8 Out-of-bounds Write Remote Code Execution Advisory (CVE-2026-87491)
[Affected Scope] Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers
Google Chrome V8 Out-of-Bounds Read/Write Vulnerability (CVE-2026-11645) Advisory
[Affected Scope] Google Chrome and Chromium-based browsers prior to version 149.0.7827.103
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.