Google has assigned a maximum CVSS severity rating of 10/10 to an actively exploited and previously disclosed zero-day vulnerability that has a scope extending much further than researchers initially thought. The flaw, tracked as CVE-2023-5129, is a heap-based buffer overflow in Google Chrome’s libwebp library, specifically rooted in the Huffman coding algorithm. The libwebp library is an open-source toolkit for WebP, a lossy compression graphics format, used by multiple browsers and image editors. A threat actor could exploit this vulnerability by executing out-of-bounds memory writes via maliciously crafted HTML pages. Successful exploitation could cause a system crash, as well as access to privileged data, and arbitrary code execution. This is a very dynamic situation since the flaw was initially thought to only affect the Chrome browser and originally given the identifier CVE-2023-4863. However, researchers found that wasn’t the case, prompting them to change the CVE identifier. Ultimately, this was a flaw in the libwebp library itself used to process WebP images by many other browsers and applications including 1Password, Signal, Safari, Mozilla Firefox, Microsoft Edge, Opera, and the native Android web browsers. The vulnerability’s extended scope means that it affects millions of applications. This vulnerability has been patched, and CTIX recommends that all readers ensure their browsers are up to date by running the most stable and secure version.