CVE-2022-2294

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Google	Chrome	>= unspecified, < 103.0.5060.114

References

http://www.openwall.com/lists/oss-security/2022/07/28/2Mailing List, Third Party Advisory
https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1341043Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/Broken Link
https://security.gentoo.org/glsa/202208-35Third Party Advisory
https://security.gentoo.org/glsa/202208-39Third Party Advisory
https://security.gentoo.org/glsa/202311-11Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/28/2Mailing List, Third Party Advisory
https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1341043Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/Broken Link
https://security.gentoo.org/glsa/202208-35Third Party Advisory
https://security.gentoo.org/glsa/202208-39Third Party Advisory
https://security.gentoo.org/glsa/202311-11Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294US Government Resource

Timeline

Published: Jul 28, 2022
Last modified: Aug 4, 2026
Added to CISA KEV: Aug 25, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-229418.8An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publishe CVE-2022-229427.8The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other CVE-2022-229436.7VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with loca CVE-2022-229445.4VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in V CVE-2022-229457.8VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitra CVE-2022-229465.5In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates CVE-2022-2294710.0In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat CVE-2022-229486.5The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administ CVE-2022-22958.8Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2022-229506.5n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp CVE-2022-229519.1VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS CVE-2022-229529.1VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file