The Return of Candiru: Zero-days in the Middle East

We recently discovered a zero-day vulnerability in Google Chrome (CVE-2022-2294) when it was exploited in the wild in an attempt to attack Avast users in the Middle East. The vulnerability was a memory corruption in WebRTC that was abused to achieve shellcode execution in Chrome’s renderer process. We reported this vulnerability to Google, who patched it on July 4, 2022.

The post The Return of Candiru: Zero-days in the Middle East appeared first on Avast Threat Labs.

candiru cve-2022-2294 exploit google chrome middle east pc return zero-day zero-days