CVE-2022-2294
KEVRansomware UseWebRTC Heap Buffer Overflow Vulnerability
Description
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPublishedJul 28, 2022
Last modifiedAug 4, 2026
Added to KEVAug 25, 2022
Remediation dueSep 15, 2022
References
- openwall.com/lists/oss-security/2022/07/28/2Mailing ListThird Party Advisory
- chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.htmlRelease NotesVendor Advisory
- crbug.com/1341043Permissions Required
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/Broken Link
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/Broken Link
- security.gentoo.org/glsa/202208-35Third Party Advisory
- security.gentoo.org/glsa/202208-39Third Party Advisory
- security.gentoo.org/glsa/202311-11Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294US Government Resource
0 recent articles mention this CVE
91
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1503 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 70.8% · top 1% of all CVEs
- Weakness
- CWE-787
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.