August 25, 2022 · Applied Cybernetics Group
CVE-2022-2294 — WebRTC WebRTC
known ransomware use
WebRTC Heap Buffer Overflow Vulnerability
- Added to KEV
2022-08-25- Federal due date
2022-09-15- Vendor
- WebRTC
- Product
- WebRTC
- EPSS
- 99.4th percentile (score 0.705, as of
2026-09-16) - NVD CVSS v3.1
- 8.8 (HIGH)
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2022-2294
CISA short description
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
Required action
Apply updates per vendor instructions.
NVD description
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.