i downloaded a webp image a few days ago is my pc compromised, very confused apologies

  • @skip0110@lemm.eeEnglish
    33•9 months ago

    A malformed (attacker crafted) webp file could cause Chrome (or other Chrome based browsers) to execute arbitrary code when rendering it. The file might be embedded in a web page you view. Other applications that use Skia for graphics are theoretically affected too.

      • @Knusper@feddit.de
        48•9 months ago

        SVG is for vector graphics, i.e. anything that can be described with lines and shapes, like logos or most icons.
        WebP on the other hand is for raster graphics. For example, cameras create raster graphics.

        So, while SVG may be able to replace WebP for some use-cases, it makes no sense to generally switch to SVG.
        A suitable, better replacement for WebP is JPEG XL.

        • 𝕽𝖚𝖆𝖎𝖉𝖍𝖗𝖎𝖌𝖍
          7•9 months ago

          In oelden days, I once made an entire (small) web site out of SVG. All the layout, everything; it was before responsive design, and before SVG had text wrap. It had animations and everything.

          In a way, it was pretty cool; like PDF web pages. Everything was always perfectly and faithfully laid out. But the downside was that everything was always perfectly laid out … for exactly one display dimensions.

          I still have a soft spot in my heart for SVG. I wish it were more widely used, and that svgz was more well supported. But yeah, you’re right: it’s not the best choice for a lot of graphics.

        • Granixo
          2•9 months ago

          Haven’t heard of JPEG XL, will investigate further. 🤓

          Thanks! 😃

          • @Knusper@feddit.de
            9•9 months ago

            JPEG XL is just a new standard from the Joint Photographic Experts Group. It doesn’t have much to do with the original JPEG standard from 1992. For example, JPEG XL also supports lossless compression, which PNG was traditionally used for.

            And yes, WebP was developed to supersede JPEG, however it was developed at Google without much input from the industry. As such, it never gained particularly widespread support.
            JPEG XL is a newer standard compared to WebP, developed in a joint venture by more of the industry (including Google), and from what I’ve heard, it makes several significant improvements compared to WebP.

            It is a very new standard, so it probably is still behind WebP in terms of adoption, but I’d expect that to flip pretty soon.

            Personal opinion: I just think WebP is poop.
            You can have images with huge resolutions that still look incredibly blurry.

              • @Knusper@feddit.de
                4•9 months ago

                Honestly, I have no idea. It sounds like AVIF also has wide industry support and is generally quite proficient.

                But JPEG XL likely wouldn’t have been created, if AVIF was perfect. Wikipedia says:

                The [JPEG XL] standard is expected to outperform the still image compression performance shown by HEIC, AVIF, WebP, and JPEG 2000. It also provides efficient lossless recompression options for images in the traditional/legacy JPEG format.

                I’m guessing, AVIF was created, because it basically already existed. It’s using the AV1 video codec to encode a single-frame video and that just happened to be better than the competition.
                JPEG XL being more focused on those still images could obviously still outperform it. I guess, we’ll have to see.

                For right now, though, yeah, JPEG XL might still be too young and AVIF therefore the better choice.

  • Brkdncr
    9•9 months ago

    Anything that decodes webp images is vulnerable to an attack. Unless the vendor of the app says they patched it, assume they have not.

    Browsers are obvious, but lots of other things decodes images. Your text messaging app, atm machines, vehicle infotainment, the ticket swipe at the airport. Anything designed to capture, process, or display anything is suspect, along with the underlying os of anything.

    • m-p{3}English
      2•9 months ago

      So many apps that we use nowadays are based on Electron, which is a web browser by itself. Those using Discord, Spotify, etc will want to update their app ASAP.

  • Big PEnglish
    8•9 months ago

    You’re probably alright. Just make sure your stuff is up to date and if you notice any weird behaviour do a virus scan.