CVE-2022-2294 Details
Description
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A heap buffer overflow vulnerability has been identified in the WebRTC component of Google Chrome. This vulnerability affects versions prior to 103.0.5060.114 and allows remote attackers to potentially exploit heap corruption by using a crafted HTML page. The issue arises from insufficient input validation, which can be manipulated to overwrite memory in a way that could lead to arbitrary code execution.
Users can upgrade to Google Chrome version 103.0.5060.114 or later to address this vulnerability. Instructions for updating can be found on the Google Chrome website. Additionally, this vulnerability is fixed in the latest versions of Chromium and Microsoft Edge.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2022References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| WebRTC Heap Buffer Overflow Vulnerability | Aug 25, 2022 | Sep 15, 2022 | Apply updates per vendor instructions. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-787 | Out-of-bounds Write | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| google chrome | < 103.0.5060.114 |
CPE
Remediation
| |
| fedoraproject extra packages for enterprise linux | 8.0 |
CPE
Remediation
| |
| fedoraproject fedora | 35 36 |
CPE
Remediation
| |
| webkitgtk webkitgtk | < 2.36.5 |
CPE
Remediation
| |
| wpewebkit wpe webkit | < 2.36.5 |
CPE
Remediation
| |
| apple ipados | < 15.6 |
CPE
Remediation
| |
| apple iphone os | < 15.6 |
CPE
Remediation
| |
| apple mac os x | < 10.15.7 10.15.7 - 10.15.7 security_update_2020 10.15.7 security_update_2020-001 10.15.7 security_update_2020-005 10.15.7 security_update_2020-007 10.15.7 security_update_2021-001 10.15.7 security_update_2021-002 10.15.7 security_update_2021-003 10.15.7 security_update_2021-004 10.15.7 security_update_2021-005 10.15.7 security_update_2021-006 10.15.7 security_update_2021-007 10.15.7 security_update_2021-008 10.15.7 security_update_2022-001 10.15.7 security_update_2022-002 10.15.7 security_update_2022-003 10.15.7 security_update_2022-004 |
CPE
Remediation
| |
| apple macos | < 11.6.8 >= 12.0, < 12.5 |
CPE
Remediation
| |
| apple tvos | < 15.6 |
CPE
Remediation
| |
| apple watchos | < 8.7 |
CPE
Remediation
| |
| webrtc project webrtc | All versions |
CPE
Remediation
| |
Change History
21 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Oct 24, 2025 | Modified Analysis | [email protected] |
| Oct 22, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Apr 3, 2025 | Modified Analysis | [email protected] |
| Feb 3, 2025 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| Jun 28, 2024 | Modified Analysis | [email protected] |
| May 14, 2024 | CVE Modified | [email protected] |
| Nov 25, 2023 | CVE Modified | [email protected] |
| Nov 7, 2023 | CVE Modified | [email protected] |
| Nov 29, 2022 | Reanalysis | [email protected] |
| Oct 26, 2022 | Modified Analysis | [email protected] |
| Sep 1, 2022 | CVE Modified | [email protected] |
| Aug 21, 2022 | CVE Modified | [email protected] |
| Aug 4, 2022 | Initial Analysis | [email protected] |
| Jul 29, 2022 | CVE Modified | [email protected] |
| Jul 28, 2022 | CVE Modified | [email protected] |