On July 4, 2022, the Google Chrome stable channel was updated to version 103.0.5060.114. The vulnerabilities fixed by this update include CVE-2022-2294. In the changelog, Google
mentioned that the company is aware of a vulnerability exploited by hackers in the wild, and this vulnerability refers to a WebRTC buffer overflow.
Unlike regular vulnerabilities that require users to click a specific link or install specific software, the vulnerability exploited by Candiru spyware does not require user interaction. Its malicious code can be embedded in well-known websites such as news websites through other attack methods, and victims will be infected immediately whenever they visit these websites.
Affected browsers include but are not limited to Google Chrome, in fact, any browser based on the Chromium kernel will exist this vulnerability. In one case, attackers compromised a Lebanese news organization to enable JavaScript snippets used in XSS cross-site scripting attacks on its website. When the victim visits the website, the attacker will call 50 data points to analyze it, and if it is determined to be the target user, it will use the vulnerability to establish a data exchange. “The collected information includes the victim’s language, timezone, screen information, device type, browser plugins, referrer, device memory, cookie functionality, and more,” explains Avast’s report.
Since the vulnerability is in WebRTC, it also affects Apple’s Safari browser, but the vulnerability discovered by Avast only applies to Windows systems.
For users, no one knows when and what vulnerabilities will be discovered, but the only thing that can be done is to update browsers and other software in a timely manner to block the vulnerabilities. The vulnerability mentioned above was discovered and exploited as early as March, and the actual exploit time should have been earlier, and Avast could not find the earliest exploit event. After the vulnerability report, Google quickly released a new version to fix it, Microsoft followed up the next day, and Apple released a patch to fix the Safari browser on July 20. At present, most browsers have been upgraded, and at least the exploitation of this vulnerability has failed.
