TLP:CLEARKNOWN EXPLOITEDAnalyzedPublished 12 Sept 2023 · Updated 17 Jun 2026
CVE-2023-4863
8.8HighCVSS 3.1
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- Affected software
- Google Chrome
- Versions
- 116.0.5845.187 up to 116.0.5845.187
- Weakness
- CWE-787 · Out-of-bounds write
- Assigned by
- Chrome
- Known exploited since
- 13 Sept 2023 (CISA KEV)
- NVD status
- Analyzed
ReferencesNVD https://nvd.nist.gov/vuln/detail/CVE-2023-4863 CVE.org https://www.cve.org/CVERecord?id=CVE-2023-4863 Vendor Advisory https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.htmlIssue Tracking https://crbug.com/1479274Release Notes https://en.bandisoft.com/honeyview/history/Patch https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17aRelease Notes https://github.com/webmproject/libwebp/releases/tag/v1.3.2