CVE-2023-4863 - Heap Buffer Overflow in WebP, Google Chrome’s Critical Security Flaw Explained

In September 2023, a severe vulnerability shook the security world: CVE-2023-4863. Lurking in the very core of Google Chrome was a heap buffer overflow flaw within the widely used WebP image library, opening the door for attackers to _run their own code_ on your system—even just by getting you to visit a malicious web page.

This post walks you through how this bug works, why it’s dangerous, code samples to demonstrate the problem, links to original references, and how attackers can exploit it in real life.

What Is WebP and Why Does It Matter?

WebP is an image format by Google, offering small image sizes with good quality. Chrome uses it everywhere. When you visit a page with a .webp image, the browser decodes it with the libwebp library. That library had a hidden critical bug.

What Exactly is CVE-2023-4863?

CVE-2023-4863 is a heap buffer overflow in how WebP handles "lossless" image data. Specifically, it allowed a remote attacker to craft a malicious WebP image file that, when rendered by Chrome (before version 116..5845.187), could write outside the memory designated for the image.

This is very dangerous! Once an attacker controls where and what is written in memory, they can often run code, install malware, or take over your system—especially since browsers process images from millions of unknown sources every day.

The Technical Details: How Does the Bug Work?

This bug centers on the WebP Reference Decoder (libwebp), particularly the “lossless” code path. There's an error in the calculation of buffer sizes during certain decoding operations.

In simple terms:  
When decoding some weirdly crafted WebP images, the browser allocated memory for the image but allowed certain image operations (like color transformations or blending) to write more data than there's space for—leading to a heap buffer overflow.

Code Snippet (Vulnerable Pseudocode)

Here’s a simplified, illustrative pseudocode from the problematic area in decoder (not the actual source, but conceptually similar):

// Assume 'data' comes from a possibly malicious image file
int out_size = width * height * 4;  // Calculate expected output size
uint8_t* out_buffer = malloc(out_size);

if (decode_lossless(data, out_buffer, out_size)) {
    // ... (use out_buffer)
}

But inside the decode_lossless function, due to an off-by-one bug, or missing bounds checks, the code might accidentally write more than out_size bytes into out_buffer.

The victim’s Chrome auto-decodes the WebP image.

4. The WebP decoder overflows memory, enabling the attacker to write and execute their own code in the browser.

Many public proof-of-concept exploits popped up soon after—the flaw was so critical that not just Chrome, but also Firefox, Brave, Electron, and apps on macOS, iOS, and Android were all affected (because they use the same WebP library).

Simple Exploitation Example (Conceptual)

Attackers would create a WebP file with a specially crafted pixel map to produce the overflow, then deliver that file in a <img src="evil.webp"> tag on a webpage.

Example HTML

<img src="data:image/webp;base64,UklGR...very_long_exploit_string_here...">

(*Note: For safety, not providing the actual exploit payload here*)

Visiting this page on an unpatched browser could trigger code execution.

How Bad Is This? (Severity & Impact)

Google rated this "Critical". Why?

Attackers can achieve full code execution, bypassing security boundaries.

Many other projects that use libwebp (Slack, Signal, GIMP, Thunderbird) also rushed to patch!

Links & References

- Chrome Release Notes for Security Fix
- WebP issue tracker bug 624
- MITRE CVE Record
- GHSA-4v2w-76qq-gfh5 advisory

How To Protect Yourself

- Update your browser: Make sure Chrome is version 116..5845.187 or later (in chrome://settings/help).

Conclusion

CVE-2023-4863 highlights how a simple image file can open the gates for serious cyberattacks. It’s a chilling reminder: keep your software updated, and beware the hidden complexity in even the most “harmless” data (like pictures on a web page).

Timeline

Published on: 09/12/2023 15:15:00 UTC
Last modified on: 09/18/2023 17:48:00 UTC