6 ms·

I have a few questions I'm not able to find clear answers to: 1. Are other Chrome-based browsers (e.g. Brave) affected by this? 2. Is desktop Chrome affected,

I have a few questions I'm not able to find clear answers to: 1. Are other Chrome-based browsers (e.g. Brave) affected by this? 2. Is desktop Chrome affected, or is this purely a mobile thing? 3. Why haven't I heard of WebP before? Am I living under a rock, or is this a mobile-first technology?

dboreham 3y ago
It's a Google-first technology.
- fiddlerwoaroof 3y ago
  It’s pretty broadly supported now: https://caniuse.com/webp https://caniuse.com/webp
  - oittaa 3y ago
    Many CDNs use it automatically. They detect you're on a modern browser and transparently compress sub-optimal images like PNGs without loss of quality.
    - nyanpasu64 3y ago
      Considering that "lossless" WebP comes with mandatory chroma subsampling, I'd say that WebP and not PNG is the sub-optimal image format.
      - NavinF 3y ago
        > "lossless" WebP comes with mandatory chroma subsampling Source? I've roundtripped bitmap->WebP->bitmap and got the same bits out
        nyanpasu64 3y ago
        I did find that `ffmpeg -i file.png -lossless 1 test.webp` could produce a full-res chroma image, recognized as WebP by file and opening successfully in Chrome and Firefox. I was under the impression this was not possible, but I suppose it is (today, not sure in the past). Why do I see WebP as an image format used to sneakily degrade PNG files? I've seen gaming wikis and CDNs serve PNG URLs as lossy WebP, ruining pixel art and degrading color detail in 2D art. And Discord CDN's "file.webp?size=1024&quality=lossless" serves icons/emotes with chroma subsampling (and ffprobe doesn't say the file is lossless, unlike test.webp above).
        NavinF 3y ago
        Umm why not use `cwebp -lossless`? That's the official solution and it even guarantees preservation of transparent pixels with `-exact`: https://developers.google.com/speed/webp/docs/cwebp https://developers.google.com/speed/webp/docs/cwebp > today, not sure in the past Dunno about ffmpeg, but the official library supported lossless encoding a decade ago > Why do I see WebP as an image format used to sneakily degrade PNG files? Why does Twitter reencode PNG to JPEG even when this results in larger file sizes and terrible quality for 2D art and technical drawings? All the services you've listed are free and they all cater to the lowest common denominator. They'll never use lossless WebP by default for the same reason they won't use PNG. Lossless media is virtually unheard-of outside our bubbles. If you're lucky there will be a "download original" button
aidenn0 3y ago
> 3. Why haven't I heard of WebP before? Am I living under a rock, or is this a mobile-first technology? It's been supported in desktop chrome for a long while. There's dozens of JPEG replacements that have come and gone, and WebP is primarily notable for having Google's clout behind it. When Google bought Duck/On2 they got a lot of video compression technology, some of which went into WebP.
- mschuster91 3y ago
  At the scale of Youtube and Google Image Search, saving even 1% of data transfer is worth a lot of money and yak-shaving efforts.
  - aidenn0 3y ago
    Oh, it's definitely something that makes/made sense for them to do; just pointing out that not knowing one of many JPEG replacements doesn't mean you live under a rock.
    - not2b 3y ago
      WEBP is more of a PNG replacement; better lossless image compression. And it's claimed to be about 25% smaller.
      - aidenn0 3y ago
        s/JPEG/PNG/ and my comment still works. In any event it's clearly designed for both, since the lossy and lossless modes are relatively independent of each other.
  - eviks 3y ago
    So why are they fighting the better JXL?
benhawkes 3y ago
Good questions -- yes other Chromium-based browsers would likely be affected by this bug. Many of these do a commendable job of following security updates in Chromium (like Brave), but others tend to fall quite far behind (like Samsung's SBrowser). Chrome desktop was affected as well, both on Linux and Windows. Chrome bundles its own version of libwebp, so even if your Linux distribution hasn't patched yet, as long as Chrome is up-to-date you should be OK (in terms of browser attacks at least). There's lots of wonderfully obscure image file formats that are supported by the major browsers and operating systems. For example you can load a KTX2 file (Khronos Texture Container) on MacOS, or a DNG file (Adobe Digital Negative) on Android. Lots of interesting and highly exposed attack surface for attackers to explore.
- omginternets 3y ago
  >Chrome desktop was affected as well, both on Linux and Windows. Not MacOS though?
  - benhawkes 3y ago
    Chrome on MacOS was affected as well, yeah. Note that we don't know if attackers exploited the bug on platforms other than iOS, but its certainly possible that they did (I'd argue even probable).
  - Bluecobra 3y ago
    MacOS is affected. Sadly there hasn't been much coverage on this... Also for corporate users this is a pain as you have to update Safari via Software Update unlike browsers like Chrome which automatically update. Safari: https://support.apple.com/en-us/HT213930 https://support.apple.com/en-us/HT213930 MacOS: https://support.apple.com/en-us/HT213906 https://support.apple.com/en-us/HT213906 https://support.apple.com/en-us/HT213915 https://support.apple.com/en-us/HT213915 https://support.apple.com/en-us/HT213914 https://support.apple.com/en-us/HT213914
- vGPU 3y ago
  A DNG is in no way an obscure file format. iPhones shoot in DNG when using proraw. DJI drones shoot in DNG. Etc.
pornel 3y ago
1. Everything that supports WebP is affected. Not just Chrome and Electron, but all browsers, desktop and mobile, and non-browser software too. All kinds of image viewers, graphics programs, email clients, even your file manager that shows thumbnails. The bug is in the codec library, and WebP has implementation monoculture, so everyone uses the same library, and everyone needs to patch. 3. Google tried to make WebP a thing 10 years ago, but it didn't get much traction, since it was Chrome-only for a long time. It never got properly standardized (it is open source tho). It compresses low-quality images better than JPEG, but tends to blur and smear colors in higher-quality images. Ironically WebP became widely supported at the same time when it became technically obsoleted by AVIF and JPEG XL.
- teruakohatu 3y ago
  > but all browsers, and non-browser software too It is a libwebp vuln right? So anyone that does not link to libwebp is or may be ok.
  - tedunangst 3y ago
    Pretty long tail of apps that shell out to imagemagick to convert stuff, too.
  - not2b 3y ago
    A security update for libwebp has been shipped by the major Linux distros.
  - jandrese 3y ago
    Yeah, but once you fix the library the system should be safe. Well, except for all of the snaps and docker containers and whatnot. Those will need to be updated as well.
- moffkalast 3y ago
  > even your file manager that shows thumbnails Aha! Finally the day has come when KDE's Dolphin emerges as the most secure file manager, in a "this sign can't stop me because I can't read" fashion.
wooque 3y ago
Every browser is affected, Firefox issued security update as well. WebP is gaining popularity as replacement for JPEG, I'm surprised you haven't stumbled it on yet, cause more and more images I download from the web turn out to be WebP.
- magicalhippo 3y ago
  > Firefox issued security update as well Fixed[1] in Firefox 117.0.1 as well as some ESR and Thunderbird versions. [1]: https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-4...
NavinF 3y ago
You've almost certainly downloaded WebP images, but you didn't realize it because many websites serve multiple formats at the same URL. This is often done with a HTTP reverse proxy that automatically converts between formats so if you have a modern (last decade) browser, you'll get a WebP even if the download's file extension seems to be ".png". All modern image editors support WebP so you'll never notice the difference
- whywhywhywhy 3y ago
  >All modern image editors support WebP so you'll never notice the difference This support has always been overstated. Photoshop still doesn’t support it, you encounter other weirdness like Apple Preview.app can view them but not edit them.
  - NavinF 3y ago
    Photoshop definitely supports it: https://helpx.adobe.com/photoshop/kb/support-webp-image-format.html https://helpx.adobe.com/photoshop/kb/support-webp-image-form... Preview.app is the exception to the rule, but it still has acceptable UX. After you finish drawing the first brush stroke on a WebP file, it will ask you to reopen the edited file as a tiff before you continue editing. No loss of data or functionality
- joveian 3y ago
  On The Guardian for example it looks like I'm getting WebP for the photo collections and AVIF for the story images, both from .jpg URLs (in Firefox hit Ctl-I to see image info). Their photo galleries have been WebP for years. Firefox is clever enough to correct the suffix if you try to save it.
- noir_lord 3y ago
  Cloudflare Polish and similar will transparently do it as well, as long as the Accept header contains webp.

dboreham 3y ago

It's a Google-first technology.

fiddlerwoaroof 3y ago
It’s pretty broadly supported now: https://caniuse.com/webp https://caniuse.com/webp
- oittaa 3y ago
  Many CDNs use it automatically. They detect you're on a modern browser and transparently compress sub-optimal images like PNGs without loss of quality.
  - nyanpasu64 3y ago
    Considering that "lossless" WebP comes with mandatory chroma subsampling, I'd say that WebP and not PNG is the sub-optimal image format.
    - NavinF 3y ago
      > "lossless" WebP comes with mandatory chroma subsampling Source? I've roundtripped bitmap->WebP->bitmap and got the same bits out
      - nyanpasu64 3y ago
        I did find that `ffmpeg -i file.png -lossless 1 test.webp` could produce a full-res chroma image, recognized as WebP by file and opening successfully in Chrome and Firefox. I was under the impression this was not possible, but I suppose it is (today, not sure in the past). Why do I see WebP as an image format used to sneakily degrade PNG files? I've seen gaming wikis and CDNs serve PNG URLs as lossy WebP, ruining pixel art and degrading color detail in 2D art. And Discord CDN's "file.webp?size=1024&quality=lossless" serves icons/emotes with chroma subsampling (and ffprobe doesn't say the file is lossless, unlike test.webp above).
        NavinF 3y ago
        Umm why not use `cwebp -lossless`? That's the official solution and it even guarantees preservation of transparent pixels with `-exact`: https://developers.google.com/speed/webp/docs/cwebp https://developers.google.com/speed/webp/docs/cwebp > today, not sure in the past Dunno about ffmpeg, but the official library supported lossless encoding a decade ago > Why do I see WebP as an image format used to sneakily degrade PNG files? Why does Twitter reencode PNG to JPEG even when this results in larger file sizes and terrible quality for 2D art and technical drawings? All the services you've listed are free and they all cater to the lowest common denominator. They'll never use lossless WebP by default for the same reason they won't use PNG. Lossless media is virtually unheard-of outside our bubbles. If you're lucky there will be a "download original" button

aidenn0 3y ago

> 3. Why haven't I heard of WebP before? Am I living under a rock, or is this a mobile-first technology? It's been supported in desktop chrome for a long while. There's dozens of JPEG replacements that have come and gone, and WebP is primarily notable for having Google's clout behind it. When Google bought Duck/On2 they got a lot of video compression technology, some of which went into WebP.

mschuster91 3y ago
At the scale of Youtube and Google Image Search, saving even 1% of data transfer is worth a lot of money and yak-shaving efforts.
- aidenn0 3y ago
  Oh, it's definitely something that makes/made sense for them to do; just pointing out that not knowing one of many JPEG replacements doesn't mean you live under a rock.
  - not2b 3y ago
    WEBP is more of a PNG replacement; better lossless image compression. And it's claimed to be about 25% smaller.
    - aidenn0 3y ago
      s/JPEG/PNG/ and my comment still works. In any event it's clearly designed for both, since the lossy and lossless modes are relatively independent of each other.
- eviks 3y ago
  So why are they fighting the better JXL?

benhawkes 3y ago

Good questions -- yes other Chromium-based browsers would likely be affected by this bug. Many of these do a commendable job of following security updates in Chromium (like Brave), but others tend to fall quite far behind (like Samsung's SBrowser). Chrome desktop was affected as well, both on Linux and Windows. Chrome bundles its own version of libwebp, so even if your Linux distribution hasn't patched yet, as long as Chrome is up-to-date you should be OK (in terms of browser attacks at least). There's lots of wonderfully obscure image file formats that are supported by the major browsers and operating systems. For example you can load a KTX2 file (Khronos Texture Container) on MacOS, or a DNG file (Adobe Digital Negative) on Android. Lots of interesting and highly exposed attack surface for attackers to explore.

omginternets 3y ago
>Chrome desktop was affected as well, both on Linux and Windows. Not MacOS though?
- benhawkes 3y ago
  Chrome on MacOS was affected as well, yeah. Note that we don't know if attackers exploited the bug on platforms other than iOS, but its certainly possible that they did (I'd argue even probable).
- Bluecobra 3y ago
  MacOS is affected. Sadly there hasn't been much coverage on this... Also for corporate users this is a pain as you have to update Safari via Software Update unlike browsers like Chrome which automatically update. Safari: https://support.apple.com/en-us/HT213930 https://support.apple.com/en-us/HT213930 MacOS: https://support.apple.com/en-us/HT213906 https://support.apple.com/en-us/HT213906 https://support.apple.com/en-us/HT213915 https://support.apple.com/en-us/HT213915 https://support.apple.com/en-us/HT213914 https://support.apple.com/en-us/HT213914
vGPU 3y ago
A DNG is in no way an obscure file format. iPhones shoot in DNG when using proraw. DJI drones shoot in DNG. Etc.

pornel 3y ago

1. Everything that supports WebP is affected. Not just Chrome and Electron, but all browsers, desktop and mobile, and non-browser software too. All kinds of image viewers, graphics programs, email clients, even your file manager that shows thumbnails. The bug is in the codec library, and WebP has implementation monoculture, so everyone uses the same library, and everyone needs to patch. 3. Google tried to make WebP a thing 10 years ago, but it didn't get much traction, since it was Chrome-only for a long time. It never got properly standardized (it is open source tho). It compresses low-quality images better than JPEG, but tends to blur and smear colors in higher-quality images. Ironically WebP became widely supported at the same time when it became technically obsoleted by AVIF and JPEG XL.

teruakohatu 3y ago
> but all browsers, and non-browser software too It is a libwebp vuln right? So anyone that does not link to libwebp is or may be ok.
- tedunangst 3y ago
  Pretty long tail of apps that shell out to imagemagick to convert stuff, too.
- not2b 3y ago
  A security update for libwebp has been shipped by the major Linux distros.
- jandrese 3y ago
  Yeah, but once you fix the library the system should be safe. Well, except for all of the snaps and docker containers and whatnot. Those will need to be updated as well.
moffkalast 3y ago
> even your file manager that shows thumbnails Aha! Finally the day has come when KDE's Dolphin emerges as the most secure file manager, in a "this sign can't stop me because I can't read" fashion.

wooque 3y ago

Every browser is affected, Firefox issued security update as well. WebP is gaining popularity as replacement for JPEG, I'm surprised you haven't stumbled it on yet, cause more and more images I download from the web turn out to be WebP.

magicalhippo 3y ago
> Firefox issued security update as well Fixed[1] in Firefox 117.0.1 as well as some ESR and Thunderbird versions. [1]: https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-4...

NavinF 3y ago

You've almost certainly downloaded WebP images, but you didn't realize it because many websites serve multiple formats at the same URL. This is often done with a HTTP reverse proxy that automatically converts between formats so if you have a modern (last decade) browser, you'll get a WebP even if the download's file extension seems to be ".png". All modern image editors support WebP so you'll never notice the difference

whywhywhywhy 3y ago
>All modern image editors support WebP so you'll never notice the difference This support has always been overstated. Photoshop still doesn’t support it, you encounter other weirdness like Apple Preview.app can view them but not edit them.
- NavinF 3y ago
  Photoshop definitely supports it: https://helpx.adobe.com/photoshop/kb/support-webp-image-format.html https://helpx.adobe.com/photoshop/kb/support-webp-image-form... Preview.app is the exception to the rule, but it still has acceptable UX. After you finish drawing the first brush stroke on a WebP file, it will ask you to reopen the edited file as a tiff before you continue editing. No loss of data or functionality
joveian 3y ago
On The Guardian for example it looks like I'm getting WebP for the photo collections and AVIF for the story images, both from .jpg URLs (in Firefox hit Ctl-I to see image info). Their photo galleries have been WebP for years. Firefox is clever enough to correct the suffix if you try to save it.
noir_lord 3y ago
Cloudflare Polish and similar will transparently do it as well, as long as the Accept header contains webp.