CVE-2022-2294: WebRTC Heap Buffer Overflow Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 70.5% chance of exploitation in the next 30 days.

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected products

• Apple iPadOS: before 15.6 (fixed in 15.6)
• Apple iPhone OS: before 15.6 (fixed in 15.6)
• Apple Mac OS X: before 10.15.7 (fixed in 10.15.7); version 10.15.7 only
• Apple macOS: before 11.6.8 (fixed in 11.6.8); from 12.0, before 12.5 (fixed in 12.5)
• Apple tvOS: before 15.6 (fixed in 15.6)
• Apple watchOS: before 8.7 (fixed in 8.7)
• Fedoraproject Extra Packages For Enterprise Linux: version 8.0 only
• Fedoraproject Fedora: version 35 only; version 36 only
• Google Chrome: before 103.0.5060.114 (fixed in 103.0.5060.114)
• WebKitGTK WebKitGTK: before 2.36.5 (fixed in 2.36.5)
• WebRTC Project WebRTC: affected versions not specified
• Wpewebkit Wpe Webkit: before 2.36.5 (fixed in 2.36.5)

Published 2022-07-28. Last modified 2026-08-04.