Heap-Based Buffer Overflow in Google Chromium WebP (CVE‑2023‑4863) Risks Remote Code Execution
What It Is – Google Chromium’s WebP codec contains a heap‑based buffer overflow that can be triggered by a crafted HTML page, allowing an out‑of‑bounds memory write.
Exploitability – The flaw is remotely exploitable; proof‑of‑concept code has been published. The CVSS 3.1 base score is 8.8 (High).
Affected Products – Google Chromium‑based browsers and any application that embeds the WebP codec (e.g., Electron apps, custom browsers).
Why It Matters for Trust & Control Assurance
- Tests the vulnerability‑management control objective: “Maintain a documented process to identify, assess, and remediate software vulnerabilities.”
- Demonstrates the need for continuous evidence collection that patches are applied across all WebP‑using assets – a key trust signal for auditors.
- Highlights the importance of defensible audit trails (patch‑level inventories, remediation tickets) that enterprise buyers now demand when evaluating software supply‑chain risk.
Recommended Actions
- Deploy the latest Chromium security update that addresses CVE‑2023‑4863 across all browsers and embedded WebP components.
- Conduct an inventory of all internal applications that ship the WebP codec; verify they are patched or disabled.
- Enable browser‑level mitigations (e.g., site isolation, sandboxing) and monitor for anomalous memory‑corruption alerts in endpoint telemetry.
- Capture remediation evidence (patch version, deployment logs) in a centralized control‑mapping repository for audit readiness.
Source: CISA KEV – CVE‑2023‑4863