CVSS 8.8 HIGH Bulletin: Google Chrome Stable Channel Update (2022-07-04) Published: 2022-07-04

CVE-2022-2294: Google Chrome WebRTC Heap Buffer Overflow Zero-Day RCE (Candiru Mercenary Spyware)

Technical intelligence and weaponization dossier for CVE-2022-2294. Documented exploitation across 1 active malware families totaling 45 analyzed telemetry samples.

Attributed Families

Sample Volume

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2022-2294
Common Name / Bulletin	Google Chrome WebRTC Heap Buffer Overflow Zero-Day RCE (Candiru Mercenary Spyware) (`Google Chrome Stable Channel Update (2022-07-04)`)
CWE Classification	`CWE-122: Heap-based Buffer Overflow in WebRTC`
Affected Software & Versions	Google Chrome prior to 103.0.5060.114, Microsoft Edge, Chromium-based browsers
Technical Root Cause	Heap buffer overflow flaw in the WebRTC (Web Real-Time Communication) component of Google Chrome. Discovered in the wild by Avast, weaponized by Candiru to target journalists and activists via malicious watering-hole websites.
Associated ATT&CK Techniques	`T1203` — Associated ATT&CK Technique `T1189` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2022-2294

Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

1 families

Malware Family	Category	Catalog Samples	Operational Profile
candiru	Spyware	`45`	Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor speciali...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2022-2294 in enterprise intrusions and campaign toolkits:

Candiru — Attributed Threat Group / Campaign Operator
Saito Tech Ltd — Attributed Threat Group / Campaign Operator
Taveta — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2022-2294 in enterprise networks:

Web browser telemetry: Sudden chrome.exe / msedge.exe render process crashes during WebRTC media stream initialization followed by unbacked memory execution.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Deploy Google Chrome 103.0.5060.114 or later; disable WebRTC where not operationally necessary; implement aggressive web content filtering.

For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →

← Return to Vulnerability Matrix Directory (All 63 CVEs)