Solved Critical WebP exploit. Any patched Win7 web browsers?

[Quisquose]

There is a critical flaw in Google's WebP image format that is already being exploited in the wild. All major browsers have rushed out patched versions due to the severity of the issue.

This massive exploit lets hackers breach your favorite apps | Digital Trends

As I understand it, Mozilla is supporting Windows 7 up until September 2024, but yet they have only patched their current browser (v117.0.1) and not their Win7 compatible version.

Last month (Aug 2023) I saw this article here mentioning web browsers that are still compatible with Win7, but again I can't find any specific information (on the respective web sites) on whether any of them have been patched to deal with this WebP exploit.

Does anyone know of any patched web browsers that still work on Win7?

 

[z3r010]

Says it's fixed in the ESR Win7 version here - Security Vulnerability fixed in Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2 — Mozilla

Download the Firefox Browser in English (US) and more than 90 other languages

 

[Quisquose]

Thanks!

 

[Alejandro85]

Edge have released a new version with the fix included in their long term support version:
https://www.sevenforums.com/browser...oft-edge-released-windows-24.html#post3523906

And further diving into official links points to this:
Release notes for Microsoft Edge Security Updates | Microsoft Learn

Which points to version 109, the latest supporting Win7.

It might also indicate that this fix was actually a backport from Chrome into an earlier version of Edge, and not a proper fix in a previous Chrome release. I haven't investigated so much more, but it may indicate that other Chrome clones (including the real Chrome) don't have released such a Win7-supported fix.

 

[erpster4]

Edge have released a new version with the fix included in their long term support version:
https://www.sevenforums.com/browser...oft-edge-released-windows-24.html#post3523906

And further diving into official links points to this:
Release notes for Microsoft Edge Security Updates | Microsoft Learn

Which points to version 109, the latest supporting Win7.

It might also indicate that this fix was actually a backport from Chrome into an earlier version of Edge, and not a proper fix in a previous Chrome release. I haven't investigated so much more, but it may indicate that other Chrome clones (including the real Chrome) don't have released such a Win7-supported fix.

Chrome Releases - Stable Channel Desktop Update [109.0.5414.165]

Sunsetting support for Windows 7 / 8/8.1 and Windows Server 2012 and Windows Server 2012 R2 in 2023 - Chrome Enterprise & Education Community

the latest MSI installer downloads that contain Chrome 109.0.5414.165 from the 2nd link work on Win7 & 8.x.
I know cuz I recently tested the 64bit MSI Google Chrome installer on an old Win7 x64 based Dell laptop and it installed v109.0.5414.165 just fine.