Being a much more complicated format than JPEG (WebP is based on the VP8 video codec) invites a huge attack surface because it requires so much more code to sup

Being a much more complicated format than JPEG (WebP is based on the VP8 video codec) invites a huge attack surface because it requires so much more code to support. On top of that, the fact that 99% of people (even Apple's ImageIO!) use Google's libwebp means any exploit can hit almost everyone all at once. This has actually happened: - https://nvd.nist.gov/vuln/detail/CVE-2023-41064 https://nvd.nist.gov/vuln/detail/CVE-2023-41064 - https://nvd.nist.gov/vuln/detail/CVE-2023-41061 https://nvd.nist.gov/vuln/detail/CVE-2023-41061 - https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863 - https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...