On July 4, 2022, the Google Chrome stable channel was updated to version 103.0.5060.114. The vulnerabilities fixed by this update include CVE-2022-2294. In the changelog, Google mentioned
that the company is aware of a vulnerability exploited by hackers in the wild, and this vulnerability refers to a WebRTC buffer overflow.
The vulnerability was submitted by researchers from the Avast Threat Intelligence team, who had already discovered that the vulnerability was being exploited by Israeli spyware developers. The spyware developer, Candiru, helps its clients launch attacks against users in Lebanon, Turkey, Yemen, and Palestine.
Unlike regular vulnerabilities that require users to click a specific link or install specific software, the vulnerability exploited by Candiru spyware does not require user interaction. Its malicious code can be embedded in well-known websites such as news websites through other attack methods, and victims will be infected immediately whenever they visit these websites.
Since the vulnerability is in WebRTC, it also affects Apple’s Safari browser, but the vulnerability discovered by Avast only applies to Windows systems.
For users, no one knows when and what vulnerabilities will be discovered, but the only thing that can be done is to update browsers and other software in a timely manner to block the vulnerabilities. The vulnerability mentioned above was discovered and exploited as early as March, and the actual exploit time should have been earlier, and Avast could not find the earliest exploit event. After the vulnerability report, Google quickly released a new version to fix it, Microsoft followed up the next day, and Apple released a patch to fix the Safari browser on July 20. At present, most browsers have been upgraded, and at least the exploitation of this vulnerability has failed.