CVEvulnerability

CVE-2022-2294

8.8 HIGH Known exploited Published 2022-07-28 Modified 2026-08-04 Official page ↗

CISA Known Exploited Vulnerability

WebRTC Heap Buffer Overflow Vulnerability — WebRTC WebRTC

WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

Added to KEV: 2022-08-25
Remediation due: 2022-09-15
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://groups.google.com/g/discuss-webrtc/c/5KBtZx2gvcQ; https://nvd.nist.gov/vuln/detail/CVE-2022-2294

Status: Analyzed
Published: 2022-07-28
Last modified: 2026-08-04
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-787

Description

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected configurations

• google chrome (< 103.0.5060.114) • fedoraproject extra packages for enterprise linux 8.0 • fedoraproject fedora 35 • fedoraproject fedora 36 • webkitgtk webkitgtk (< 2.36.5) • wpewebkit wpe webkit (< 2.36.5) • apple ipados (< 15.6) • apple iphone os (< 15.6) • apple mac os x (< 10.15.7) • apple mac os x 10.15.7 • apple macos (< 11.6.8) • apple macos (>= 12.0 < 12.5) • apple tvos (< 15.6) • apple watchos (< 8.7) • webrtc project webrtc

Weakness · CWE (1)

CWE-787 Out-of-bounds Write weakness

References