How the WebP Zero-Day May Have Been Discovered: A BLASTPASS Theory

Summary

The presenter proposes that researchers may have found the WebP zero-day by noticing a shared Huffman-table sizing assumption in image parsers, then fuzzing WebP. The discovery path and NSO attributions are explicitly uncertain.

Key points

The presenter offers a hypothesis about how the WebP vulnerability was discovered, not a confirmed account of the researchers’ process.
The video describes iMessage image handling as a remote attack surface and explains that iOS BlastDoor sandboxes message parsing.
It notes that WebP support came to Image I/O with iOS 14 and that image-format parsers have been a focus of security research.
The presenter compares the WebP Huffman-table issue with image-format exploits including FORCEDENTRY and PWNYOURHOME; the video says NSO was attributed to these and BLASTPASS but cautions that attribution could be wrong.
A similar Huffman-table implementation in a JPEG XL library did not crash in the presenter’s fuzzing attempt, which they say may reflect a limitation in their skills or approach.
A Brunsli code comment warns that malformed JPEG input may violate assumptions used by enough.c to calculate table sizes; the presenter speculates this could have prompted further investigation.
The proposed discovery path is that a researcher noticed the similar table-sizing assumption in WebP and then fuzzed its Huffman-table implementation.

Article Details

Topics: [00:29] The WebP vulnerability and the question of how it was discovered
[01:18] iPhone remote attack surface and iMessage message processing
[04:28] Image parsing as an attack surface and the BlastDoor sandbox
[07:30] Image I/O, WebP support and prior image-parser research
[08:11] Image-format exploits and uncertain NSO attribution
[09:28] Similarities between WebP and other Huffman-table implementations
[10:51] enough.c assumptions and the Brunsli warning about malformed JPEGs
[13:39] The hypothesized discovery path through targeted fuzzing

People

natalie silvanovichThe presenter cites her Google Project Zero analysis of the iPhone’s fully remote attack surface when discussing remotely reachable messaging inputs.

Threat Actors

NSOThe presenter says NSO has been attributed to FORCEDENTRY, PWNYOURHOME and BLASTPASS, but stresses the attribution could be wrong or reflect purchased exploits.

Products

iMessageThe presenter describes iMessage as a remote attack surface where incoming image attachments are parsed and message previews are generated.