CVE-2023-4863 — Google Chromium WebP

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Added to KEV

2023-09-13

Federal due date

2023-10-04

Vendor

Google

Product

Chromium WebP

EPSS

99.8th percentile (score 0.933, as of 2026-06-08)

NVD CVSS v3.1

—

Ransomware use

Unknown

Upstream

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

CISA short description

Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS percentile is the FIRST.org exploit-probability ranking as of the date noted above; it moves daily. CVSS reflects NVD's analysis at time of publication.