zero-click

WebP BlastPass: One C Library Pwned Everything

Post author:Prabhu Kalyan Samal
Post published:September 7, 2023
Post category:Identity & Phishing Security Web & API Security

CVE-2023-4863, a heap overflow in libwebp's Huffman decoding, let the BLASTPASS chain install Pegasus via a zero-click iMessage image — and forced every browser, OS, and Electron app on earth to patch the same line of C.