What it Takes to Patch High Impact Vulnerabilities: A Retrospective on WebP CVE
summary
Dataset analysis finds 204 versions with WebP flaws and a random app sample shows Flutter at 1% Flutter of apps but with 90% initially vulnerable and about 60% still vulnerable six months after the patch; Flutter-only apps rise from 10% to 15% vulnerable as adoption jumps ~30%. The workflow demonstrates exploitability via buffer overrun in image parsing, reproduces mass-exposure numbers, and validates plug and play mitigation and CI/source-level checks that materially reduce attack surface.
AI-written summary · about
chapters (12)
- 0:00Patching high-impact vulnerabilities
- 1:11Why patching is challenging
- 2:59WebP vulnerability spread
- 4:50Flutter’s security duplication
- 7:20WebP CVE timeline
- 8:24Post-patch Flutter rates
- 10:37Root causes of delayed updates
- 12:03Developer-user knowledge gap
- 13:50Waiting for patches risks
- 15:39Inheriting vulnerable SDKs
- 16:22Security outreach
- 17:06Closing remarks
related talks
23mConflicts in Vulnerability Management and Patching
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
43mDangerous Flutter... Or Not?
28mEpidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
55mBreaking and Fixing Web Application Security
40mThe Year in Flash
45mSurvey of Notable Web Application Vulnerabilities from the Past Year
25mYou don’t have to patch!