CVE-2022-22677

What it actually does

Race condition in concurrent media state handling allows video self-preview in a WebRTC call to be interrupted when a phone call is answered due to improper synchronization of media streams.

Why it matters to the business

Disrupted video conferencing and real-time communication on affected devices can reduce user productivity and reliability of collaboration tools, though prevalence remains low across listed packages.

How an attack unfolds

An attacker positions a WebRTC session on a vulnerable system and triggers concurrent media events such as an incoming phone call; the flawed state handling interrupts the preview stream without requiring authentication or special privileges.

How to fix it

Upgrade affected packages to the listed fixed versions: nodejs/node to commit f978628b806b6650a90cd47e8b28590224af75e8; chromium on Debian 11/12/13 to 87.0.4280.88-0.1; chromium-browser on Ubuntu 16.04 LTS to 86.0.4240.75-0ubuntu0.16.04.1.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases; test WebRTC sessions with concurrent phone calls to verify preview continuity.

Typical attack path

1. Establish a WebRTC call on affected software
2. Trigger concurrent media event (phone call arrival)
3. Exploit race in media state handling to interrupt self-preview

How to detect it

Search application and system logs for WebRTC session state changes or media interruptions around phone call events; inspect process activity for concurrent media handling on chromium or nodejs runtimes.

What your security team should do

• Prioritize upgrades on any systems using listed chromium or nodejs packages with WebRTC
• Monitor EPSS trend for changes indicating rising exploitability
• Review logs for unexpected WebRTC preview interruptions coinciding with media events