---
id: "CVE-2022-2294"
kind: "vulnerability"
aliases: ["CVE-2022-2294"]
title: "Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially\u2026"
severity: "high"
cvss: 8.8
epss: 0.70833
exploited: true
status: "open"
category: "runtime"
products: [{"name": "WebRTC WebRTC", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "google chrome", "fixed": ["103.0.5060.114"], "affected": "< 103.0.5060.114", "ecosystem": "vendor"}, {"name": "fedoraproject extra packages for enterprise linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 35", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 36", "ecosystem": "vendor"}, {"name": "webkitgtk", "fixed": ["2.36.5"], "affected": "< 2.36.5", "ecosystem": "vendor"}, {"name": "wpewebkit wpe webkit", "fixed": ["2.36.5"], "affected": "< 2.36.5", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["15.6"], "affected": "< 15.6", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["15.6"], "affected": "< 15.6", "ecosystem": "vendor"}, {"name": "apple mac os x", "fixed": ["10.15.7"], "affected": "< 10.15.7", "ecosystem": "vendor"}, {"name": "apple mac os x", "fixed": [], "affected": "= 10.15.7", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["11.6.8"], "affected": "< 11.6.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["12.5"], "affected": ">= 12.0, < 12.5", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["15.6"], "affected": "< 15.6", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["8.7"], "affected": "< 8.7", "ecosystem": "vendor"}, {"name": "webrtc project webrtc", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "chrome", "exploited", "ransomware", "runtime", "webrtc"]
not_affected_if: ["patched-browser"]
published_at: "2022-07-28T02:15:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-2294", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-2294", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2294", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially…

WebRTC, the real-time communication library built into web browsers, has a heap buffer overflow that lets an attacker run shellcode. It affects browsers that use WebRTC, including Google Chrome, and CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WebRTC WebRTC affected ? fixed ?
- vendor:google chrome affected < 103.0.5060.114 fixed 103.0.5060.114
- vendor:fedoraproject extra packages for enterprise linux affected = 8.0 fixed ?
- vendor:fedoraproject fedora affected = 35 fixed ?
- vendor:fedoraproject fedora affected = 36 fixed ?
- vendor:webkitgtk affected < 2.36.5 fixed 2.36.5
- vendor:wpewebkit wpe webkit affected < 2.36.5 fixed 2.36.5
- vendor:apple ipados affected < 15.6 fixed 15.6
- vendor:apple iphone os affected < 15.6 fixed 15.6
- vendor:apple mac os x affected < 10.15.7 fixed 10.15.7
- vendor:apple mac os x affected = 10.15.7 fixed ?
- vendor:apple macos affected < 11.6.8 fixed 11.6.8
- vendor:apple macos affected >= 12.0, < 12.5 fixed 12.5
- vendor:apple tvos affected < 15.6 fixed 15.6
- vendor:apple watchos affected < 8.7 fixed 8.7
- vendor:webrtc project webrtc affected ? fixed ?

## Fix

Update affected browsers (for example Google Chrome) to the vendor's patched release, as CISA directs. Exact patched versions are unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-2294
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-2294
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-2294

## From the sources

WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_