{"id":"CVE-2022-2294","title":"Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","summary":"Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-787","CWE-787"],"vendor":"google","product":"chrome","affected":["chrome < 103.0.5060.114","extra_packages_for_enterprise_linux = 8.0","fedora = 35","fedora = 36","webkitgtk < 2.36.5","wpe_webkit < 2.36.5","ipados < 15.6","iphone_os < 15.6","mac_os_x < 10.15.7","mac_os_x = 10.15.7","macos < 11.6.8","macos >= 12.0, < 12.5","tvos < 15.6","watchos < 8.7","webrtc"],"patched":["chrome 103.0.5060.114","webkitgtk 2.36.5","wpe_webkit 2.36.5","ipados 15.6","iphone_os 15.6","mac_os_x 10.15.7","macos 12.5","tvos 15.6","watchos 8.7"],"published":"2022-07-28","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-2294","references":[{"url":"http://www.openwall.com/lists/oss-security/2022/07/28/2","label":"chrome-cve-admin@google.com"},{"url":"https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html","label":"chrome-cve-admin@google.com"},{"url":"https://crbug.com/1341043","label":"chrome-cve-admin@google.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/","label":"chrome-cve-admin@google.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/","label":"chrome-cve-admin@google.com"},{"url":"https://security.gentoo.org/glsa/202208-35","label":"chrome-cve-admin@google.com"},{"url":"https://security.gentoo.org/glsa/202208-39","label":"chrome-cve-admin@google.com"},{"url":"https://security.gentoo.org/glsa/202311-11","label":"chrome-cve-admin@google.com"},{"url":"http://www.openwall.com/lists/oss-security/2022/07/28/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://crbug.com/1341043","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202208-35","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202208-39","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202311-11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild"],"epss":0.70461,"epssPercentile":0.99377,"kev":true,"kevDateAdded":"2022-08-25","kevDueDate":"2022-09-15","kevRansomware":true,"exploited":true,"zeroDay":true,"ingestedAt":"2026-08-04T05:36:12.334Z","slug":"CVE-2022-2294","body":"## Overview\n\nHeap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\n## Affected\n\n- `chrome < 103.0.5060.114`\n- `extra_packages_for_enterprise_linux = 8.0`\n- `fedora = 35`\n- `fedora = 36`\n- `webkitgtk < 2.36.5`\n- `wpe_webkit < 2.36.5`\n- `ipados < 15.6`\n- `iphone_os < 15.6`\n- `mac_os_x < 10.15.7`\n- `mac_os_x = 10.15.7`\n- `macos < 11.6.8`\n- `macos >= 12.0, < 12.5`\n- `tvos < 15.6`\n- `watchos < 8.7`\n- `webrtc`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 103.0.5060.114`\n- `webkitgtk 2.36.5`\n- `wpe_webkit 2.36.5`\n- `ipados 15.6`\n- `iphone_os 15.6`\n- `mac_os_x 10.15.7`\n- `macos 12.5`\n- `tvos 15.6`\n- `watchos 8.7`","depth":"abyssal","depthScore":92,"depthScoreParts":{"impact":48.4,"likelihood":14.1,"exploitation":25,"ransomware":5},"changes":[]}