CVE-2022-2294

Imagine a safety-check in the browser’s real-time communication feature (WebRTC) that was too forgiving about how much data to store. Attackers can send a specially made message through a web page so the browser tries to write past the intended memory area, which can lead to the browser crashing or being manipulated. Because it was used in real ransomware activity (per CISA KEV), it’s not just a theoretical risk.

This matters if you (or your staff) use affected versions of Google Chrome on desktop, or you run affected WebKit-based browsers/components on Fedora/extra enterprise Linux packages, or on Apple devices running affected iOS/iPadOS/macOS/tvOS/watchOS versions. It’s especially relevant for businesses that browse the web normally, because the trigger is a crafted HTML page. Reachability depends on whether the vulnerable versions are installed and whether an attacker can get a victim to open the malicious page—there is no requirement for prior logins mentioned in the provided findings.

This is RED because it’s confirmed to have been used in real-world ransomware campaigns (CISA KEV listing). Attackers can use it through a malicious web page, and the vendor provided fixed versions years ago—so leaving older installations running keeps you in active attack territory.

Confirm exposure

• On each workstation/server, check the installed version of Google Chrome.
• If you manage Linux or device images, also verify the WebKitGTK and WPE WebKit versions where applicable.
• For Apple devices, verify the OS versions (iOS/iPadOS/macOS/tvOS/watchOS) against the fixed releases below.

Upgrade to the fixed versions

• Google Chrome: upgrade to 103.0.5060.114 or later.
• WebKitGTK: upgrade to 2.36.5 or later.
• WPE WebKit: upgrade to 2.36.5 or later.
• iPadOS / iOS: upgrade to 15.6 or later.
• macOS: upgrade to 10.15.7 or 11.6.8 or later (depending on your branch).
• tvOS: upgrade to 15.6 or later.
• watchOS: upgrade to 8.7 or later.

Temporary workaround (if you can’t patch immediately)

• Block or filter access to untrusted websites and reduce exposure by tightening web filtering/proxy policies.
• Treat browser sessions as high risk: avoid opening links from unknown senders, especially via email and instant messages, until updates are applied.
• Prioritize patching for systems used to browse the web or access corporate apps.

Validation and monitoring

• Re-check versions after the upgrade to confirm you are on (at least) the fixed release.
• Review browser/endpoint logs for crashes and abnormal browser behavior around the time suspicious browsing occurred.

KEV timeline

• CISA KEV remediation due date: 2022-09-15 (this should be considered overdue for any systems still on vulnerable versions).

Severity is high (heap buffer overflow; CWE-787) with a vulnerability class consistent with memory corruption. The attack mechanism described in the findings is a remote trigger via a crafted HTML page that can cause heap corruption in WebRTC within Google Chrome (and corresponding WebKit/WebRTC components across affected platforms). Exploit maturity: no public exploit code is listed in the findings, but CISA KEV confirms real-world use in ransomware campaigns, which elevates practical risk beyond “proof-of-concept only.” KEV meaning here: inclusion indicates it is known to have been exploited in the wild, and CISA expects organizations to apply vendor updates. Press attention is noted as sustained, supporting that this was widely tracked, but the decisive factor for urgency is the CISA KEV listing.