ZeroDay Findings
Sign inSign up

Findings

CVE-2022-2294

WebRTC Heap Buffer Overflow Vulnerability

Published Jul 27, 2022 · updated Aug 3, 2026 · google chrome

WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 27, 2022 · Catalog

    Detected

    WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

  2. Aug 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Sep 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 3, 2026 · Catalog

    Updated

    WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

Required action

Apply updates per vendor instructions.

CISA due date Sep 15, 2022

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe fedoraproject/extra packages for enterprise linux8.0
  • cpe fedoraproject/fedora35
  • cpe fedoraproject/fedora36
  • cpe google/chromeversion unspecified
  • cpe webkitgtk/webkitgtkversion unspecified
  • cpe webrtc project/webrtcversion unspecified
  • cpe wpewebkit/wpe webkitversion unspecified
  • vendor WebRTC WebRTCversion unspecified

Sources

  • CISA KEVCVE-2022-2294

    WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

    cisa.gov
  • CVE.orgCVE-2022-2294

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-2294

    30-day exploitation probability 70.5%

    first.org
  • NIST NVDCVE-2022-2294

    Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    nvd.nist.gov

References