A heap buffer overflow was discovered in the WebRTC component. It was reported by Jan Vojtesek from the Avast Threat Intelligence team on 2022-07-01. The vulnerability is being exploited in the wild. Chromium-based browsers are affected, e.g. Chrome, Microsoft Edge, Brave, … .
Google’s stable channel update fixes CVE-2022-2294 in Chrome 103.0.5060.114 for Windows and confirms that an exploit exists in the wild. As usual, the bug details stay locked until most users are patched. Avertium’s flash notice counts it as Chrome’s fourth zero-day of 2022 and lists Edge, Brave, Opera and Vivaldi as Chromium browsers to patch as well. A follow-up covers who used it: Candiru, in watering hole attacks in the Middle East. Four zero-days by July, so maybe leave auto-update switched on.