Security readout for executives and security teams
Plain-English summary
A malicious webpage could exploit a memory-handling flaw in Chrome's WebRTC component. Successful exploitation could compromise information, alter data, or disrupt the browser. User interaction is required, but CISA's Known Exploited Vulnerabilities listing confirms exploitation has occurred in the wild.
Executive priority
Treat as an urgent browser-remediation item because exploitation is documented and compromise could have high business impact. Require rapid fleet-wide version verification, prioritizing privileged users and sensitive systems, then track exceptions until resolved.
Technical view
CVE-2022-2294 is a WebRTC heap buffer overflow affecting Google Chrome before 103.0.5060.114. A remote, unauthenticated attacker could trigger heap corruption through crafted HTML after user interaction. It is classified as CWE-787 and scored CVSS 3.1 8.8, reflecting potential confidentiality, integrity, and availability impact.
Likely exposure
Endpoints running Google Chrome versions earlier than 103.0.5060.114 are exposed when users can visit attacker-controlled or compromised webpages. The supplied evidence does not identify affected products beyond Google Chrome or quantify current organizational exposure.
Exploitation context
CISA lists CVE-2022-2294 in its Known Exploited Vulnerabilities catalog, supporting active-exploitation status. Exploitation involves crafted HTML and requires user interaction. The supplied sources do not describe campaign scope, attacker groups, reliable exploitation rates, or public exploit availability.
Researcher notes
The available record establishes a remotely reachable WebRTC heap overflow through crafted HTML, with low attack complexity, no privileges, and required user interaction. CISA KEV inclusion supports real-world exploitation. The bundle does not establish exploit-chain dependencies, sandbox escape behavior, root cause details, indicators of compromise, or campaign attribution.
Mitigation direction
- Update Google Chrome to version 103.0.5060.114 or later immediately.
- Prioritize internet-facing user workstations and systems handling sensitive information.
- Use browser-management controls to enforce updates and prevent unsupported versions.
- Consult current Google guidance if an affected device cannot be upgraded promptly.
Validation and detection
- Inventory installed Google Chrome versions across managed endpoints.
- Confirm no Chrome installation remains below version 103.0.5060.114.
- Verify automatic updates are enabled and successfully completing.
- Review endpoint telemetry for unexpected browser crashes or suspicious activity around webpage visits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-2294 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2022-2294 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2022-08-25T00:00:00.000Z: CVE-2022-2294 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://crbug.com/1341043CVE reference, Chrome
- https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.htmlCVE reference, Chrome
- FEDORA-2022-0102ccc2a2CVE reference, Chrome · vendor-advisory
- FEDORA-2022-1d3d5a0341CVE reference, Chrome · vendor-advisory
- GLSA-202208-35CVE reference, Chrome · vendor-advisory
- GLSA-202208-39CVE reference, Chrome · vendor-advisory
- GLSA-202311-11CVE reference, Chrome · vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.