Chrome, Firefox and more caught with their WebP down, offer hasty patch-up

Google and Mozilla have rushed out a fix for a vulnerability within their browsers – Chrome and Firefox, respectively – noting an exploit already exists in the wild. The web search giant on Tuesday hurriedly issued an update for its software in response to research by Citizen Lab at the University of Toronto's Munk School. …

[ecofeco]

Oh FFS Google

See title

[DS999]

Too many image related exploits

The recent iOS patch had a fix for an ImageIO exploit.

Maybe instead of worrying about compression ratio the people designing image formats ought to insure it can't be exploited to expand to overly large sizes that can overrun buffers - the original spec for JPEG even provided sample software that claimed the buffer sizes used were the largest it could ever need. They weren't. Not even close.

Unfortunately the skill set for visual compression and the skill set for avoiding an exploitable spec don't tend to have much overlap.

[Mitoo Bobsworth]

Wot, Every Bloody Picture?

One of the more unnecessary & irritating image compression formats around.

[Ayemooth]

What about other rendering engines?

What about other rendering engines? Chrome's isn't the only one y'know!

[Anonymous Coward]

Re: What about other rendering engines?

Other rendering engines? You mean Firefox?

[diodesign]

libwebp

We've revised the piece with more details: the flaw is within libwebp, a Google-managed library that processes WebP images.

That same library is present in Firefox, Thunderbird, and other programs. So it's not just Chrome: it's anything using libwebp. Look out for patches and apply them.

C.

[mattaw2001]

Re: libwebp

Is there any information on how browser sandboxing would mitigate or help limit the damage is kind of bug would have?

[s. pam]

Chrome, when your privacy doesn't really matter!

Chrome has become the Ebola virus of browsers between these latest holes, the (in)security sandbox and all the other problems. Got to admit that we purged it years ago from our whole family for FireFox as Chrome had security debacle after debacle one too many times

[Mockup1974]

Just rip out the whole WebP code and add JPEG XL support. What's the point of WebP anyway, it's strictly inferior, and it doesn't have the legacy usecase that JPEG and PNG have.