This pull request was opened from and to a release candidate branch. This should only be done as part of the official Flutter release process. If you are attempting to make a regular contribution to the Flutter project, please close this PR and follow the instructions at Tree Hygiene for detailed instructions on contributing to Flutter.

Reviewers: Use caution before merging pull requests to release branches. Ensure the proper procedure has been followed.

Hello @itsjustkevin `,

As per flutter 3.13.4 change log, that this commit Fixes CVE-2023-4863.

According to libwebp repo, the fix for CVE-2023-4863 was released as part of v1.3.2 . The libwebp v1.3.1 doesn't contain the fix for CVE-2023-4863

cc @licaon-kter who noticed this issue first.

In fec13df the libwebp is updated to 1.3.1 2af26267cdfcb63a88e5c74a85927a12d6ca1d76. The webmproject/libwebp@2af2626 commit is the fix of the 0day backported to the 1.3.1 branch.

In fec13df the libwebp is updated to 1.3.1 2af26267cdfcb63a88e5c74a85927a12d6ca1d76. The webmproject/libwebp@2af2626 commit is the fix of the 0day backported to the 1.3.1 branch.

Thank you for clarifying.