search

GoogleChromeLabs / squoosh

Make images smaller using best-in-class codecs, right in the browser.
https://squoosh.app
Apache License 2.0
21.82k stars 1.53k forks source link

WebP Vulnerability: CVE-2023-4863 #1382

Closed jhuckaby closed 1 year ago

jhuckaby commented 1 year ago

There is a zero-day heap overflow bug in WebP: https://nvd.nist.gov/vuln/detail/CVE-2023-4863

Chrome was just updated to patch this: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html

Does the WebP WASM library that is bundled with Squoosh need to be updated as well, or does the sandbox nature of WASM protect us here?

surma commented 1 year ago

There’s no risk here thanks to the Wasm Sandbox. We should update WebP, but there is no urgency.

jhuckaby commented 1 year ago

Got it, thanks! I'll go ahead and close this issue.