ACTIVELY EXPLOITED
CVE-2022-2294: WebRTC Heap Buffer Overflow Vulnerability
| Vendor | WebRTC |
|---|---|
| Product | WebRTC |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Aug 2022 |
| CISA federal deadline | 15 Sep 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-122 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.