IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.8High KEV Used in ransomware

CVE-2022-2294WebRTC Heap Buffer Overflow Vulnerability

Google Chrome Published: (4 years ago)

Known exploited — WebRTC Heap Buffer Overflow Vulnerability

CISA confirmed this vulnerability is used in real attacks on 25.08.2022. Remediation deadline for US federal agencies: 15.09.2022.

Required action: Apply updates per vendor instructions. https://groups.google.com/g/discuss-webrtc/c/5KBtZx2gvcQ; https://nvd.nist.gov/vuln/detail/CVE-2022-2294

Description

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Weakness (CWE): CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
apple ipados < 15.6
apple iphone os < 15.6
apple mac os x < 10.15.7
apple macos < 11.6.8
apple tvos < 15.6
apple watchos < 8.7
fedoraproject extra packages for enterprise linux 8.0
fedoraproject fedora 35
Google Chrome unspecified – < 103.0.5060.114
webkitgtk webkitgtk < 2.36.5
webrtc project webrtc —
wpewebkit wpe webkit < 2.36.5

References and patches

CPE matches (NVD) (31)
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* < 103.0.5060.114
  • cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
  • cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:* < 2.36.5
  • cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:* < 2.36.5
  • cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* < 15.6
  • cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* < 15.6
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* < 10.15.7
  • cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-004:*:*:*:*:*:*
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 11.6.8
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 12.0 < 12.5
  • cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* < 15.6
  • cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* < 8.7
  • cpe:2.3:a:webrtc_project:webrtc:-:*:*:*:*:*:*:*

Recent CVEs in the same product — Google Chrome

8.8High
CVE-2026-126860
Google Chrome

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

8.8High
CVE-2026-126890
Google Chrome

Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

8.8High
CVE-2026-126899
Google Chrome

Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

4.3Medium
CVE-2026-126920
Google Chrome

Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

3.1Low
CVE-2026-126841
Google Chrome

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

8.8High
CVE-2026-126868
Google Chrome

Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)