Facebook Messenger now limits WebP file attachments | Hacker News Reader

Facebook Messenger now limits WebP file attachments

13 pointsmmsc8 comments

It appears that in response to the vulnerability (CVE-2023-4863) that affected Chrome but was caused by libwebp, Facebook has limited the uploading of webp files.

The recent "Chrome vulnerability" itself was actually a vulnerability in libwebp -- library used to manipulate webp files.

Now, when attempting to send a large webp file through messenger, I am greeted with the error:

  Unable to Add Attachment
  Your image couldn't be uploaded due to restrictions on image dimensions. Image should be less than 2048 pixels in any dimension.

I can only imagine this is some defence for their image compression systems which are possibly using the vulnerable libwebp library.

Facebook definitely isn't alone in this, and other services which compress or otherwise manipulate webp files are going to be affected by this too.

When searching HN about any posts on issues in libwebp nothing comes up.

Please do not assume that everyone has the same context as you when it comes to the subject matter that you start a thread on.

Preferably include a link to a source where the issues mentioned are listed/discussed.

I've updated OP.

I believe they are referring to CVE-2023-4863[1], see the fix commit[2] in libwebp.

I imagine the issue would also impact Electron, which might be the actual reason for blocking the format if they use that for some/all of their client apps (assuming the OP's claim is correct, I don't use it so can't check myself), because I'd like to think they could push out a back-end deployment quickly.

1: https://nvd.nist.gov/vuln/detail/CVE-2023-4863

2: https://chromium.googlesource.com/webm/libwebp/+/902bc91

Webp/Webm was never supported for me.

Maybe an iOS issue? I know Safari doesn't support WebP, so if Messenger is using a WebView on iOS then maybe that's why.

Safari does support WebP

https://caniuse.com/webp

Oh my bad, you're right. I was thinking of WebM, which iOS Safari does not support.

https://caniuse.com/webm

It's occuring on the web application (https://messenger.com/ and https://facebook.com/)

Reply on news.ycombinator.com