November 13, 2026

CVE Watchtower

CVE-2022-2294Google Chrome Out-of-bounds Write

NVDCVSS scored by NVD (NIST)

Vulnerability Summary

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity Level
HIGH(8.8)
Published Date
Jul 28, 2022
Last Modified
Aug 4, 2026
Exploitation Status
ACTIVE
EPSS Score (30-Day)
70.46%Probability
Root Weakness (CWE)
CWE-787: Out-of-bounds Write β†—
The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3.1 Base Metrics — Score 8.8 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Google Chrome < 103.0.5060.114
  • Fedoraproject Extra Packages For Enterprise Linux
  • Fedoraproject Fedora
  • Webkitgtk Webkitgtk < 2.36.5
  • Wpewebkit Wpe Webkit < 2.36.5
  • Apple Ipados < 15.6
  • Apple Iphone Os < 15.6
  • Apple Mac Os X < 10.15.7
  • Apple Mac Os X
  • Apple Macos < 11.6.8
  • Apple Macos >= 12.0 and < 12.5
  • Apple Tvos < 15.6
  • Apple Watchos < 8.7
  • Webrtc Project Webrtc
Patched Versions
  • Google Chrome 103.0.5060.114
  • Webkitgtk Webkitgtk 2.36.5
  • Wpewebkit Wpe Webkit 2.36.5
  • Apple Ipados 15.6
  • Apple Iphone Os 15.6
  • Apple Mac Os X 10.15.7
  • Apple Macos 11.6.8
  • Apple Macos 12.5
  • Apple Tvos 15.6
  • Apple Watchos 8.7

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Sep 15, 2022.

  1. Check whether you run Google Chrome and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply updates per vendor instructions.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Aug 25, 2022
Remediation due: Sep 15, 2022 (deadline passed)
Known use in ransomware campaigns: Yes

Timeline

  • Jul 28, 2022Published
  • Aug 25, 2022Added to CISA KEV catalog
  • Sep 15, 2022KEV remediation due date
  • Aug 4, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Google CVEsYou are reading CVE-2022-2294. Get an email when KEV listings, exploits or new CVEs match your stack.
Notify me about Google CVEs

Related Coverage

More Google Chrome CVEs

External References

Data last checked: Nov 13, 2026 10:08 (site time)