CVE-2023-22880: Zoom Rooms Information Disclosure Flaw

CVE-2023-22880 Overview

CVE-2023-22880 is an information disclosure vulnerability affecting Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients. The flaw results from a Microsoft Edge WebView2 runtime update that routed text entered in Zoom clients to Microsoft's online Spellcheck service rather than the local Windows Spellcheck. As a result, content typed inside affected Zoom clients could be transmitted to a remote cloud service without user awareness. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Text entered in Zoom for Windows clients was silently transmitted to Microsoft's online Spellcheck endpoint, exposing potentially sensitive meeting content, chat input, and form data to a third-party telemetry service.

Affected Products

Zoom for Windows clients before version 5.13.3
Zoom Rooms for Windows clients before version 5.13.5
Zoom VDI for Windows clients before version 5.13.1

Discovery Timeline

2023-03-16 - CVE-2023-22880 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-22880

Vulnerability Analysis

The vulnerability arises in the interaction between Zoom's Windows clients and the embedded Microsoft Edge WebView2 runtime. Zoom uses WebView2 to render portions of its interface that accept user text input. A Microsoft Edge WebView2 update changed the default spellcheck behavior, sending text content to Microsoft's cloud-based Spellcheck service instead of the on-device Windows Spellcheck engine. Affected Zoom clients did not explicitly disable this cloud-based feature.

The practical effect is silent data exposure. Any text typed into WebView2-rendered fields within Zoom — including chat input, meeting metadata, and other user-supplied strings — could be transmitted to Microsoft over the network. The user receives no in-application indication that text is leaving the host.

Root Cause

The root cause is an insecure default in a third-party runtime component combined with a missing configuration override in the host application. Zoom relied on WebView2 default behavior. When Microsoft changed that behavior to use the online Spellcheck service, Zoom did not pin or disable the relevant WebView2 feature flag controlling cloud spellcheck.

Attack Vector

Exploitation does not require an active adversary. The exposure occurs automatically when an affected Zoom client renders any WebView2 surface that accepts text input. An attacker positioned to observe or compel logging at the Microsoft Spellcheck endpoint, or anyone with lawful access to that telemetry pipeline, could view transmitted text. The disclosure is unidirectional and affects confidentiality only — integrity and availability are not impacted.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2023-22880

Indicators of Compromise

Outbound HTTPS connections from Zoom.exe, ZoomRooms.exe, or related Zoom processes to Microsoft Spellcheck telemetry endpoints associated with Edge WebView2.
Presence of WebView2 runtime versions earlier than 109.0.1481.0 on hosts running Zoom for Windows.
Installed Zoom client versions earlier than 5.13.3 (Zoom), 5.13.5 (Zoom Rooms), or 5.13.1 (Zoom VDI).

Detection Strategies

Inventory all Windows endpoints for installed Zoom client versions and WebView2 runtime versions using software asset management or endpoint telemetry.
Inspect network egress logs for Zoom processes connecting to Microsoft online Spellcheck service hostnames.
Correlate WebView2 process activity with outbound destinations that fall outside expected Zoom service endpoints.

Monitoring Recommendations

Alert on any Zoom client version drift below the patched baselines listed in the Zoom Security Bulletin.
Track WebView2 runtime versions across the fleet and flag hosts below 109.0.1481.0.
Review DLP egress policies to confirm that unexpected cloud spellcheck destinations are logged or blocked.

How to Mitigate CVE-2023-22880

Immediate Actions Required

Update Zoom for Windows to version 5.13.3 or later, Zoom Rooms for Windows to 5.13.5 or later, and Zoom VDI for Windows to 5.13.1 or later.
Update the Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 on all hosts running affected Zoom clients, then restart Zoom.
Audit endpoints with privileged users, executive staff, and regulated-data handlers first.

Patch Information

Zoom remediated CVE-2023-22880 by disabling the cloud spellcheck feature in affected clients. Updating the Microsoft Edge WebView2 Runtime to 109.0.1481.0 or later also remediates the issue by changing Microsoft's underlying telemetry behavior. Refer to the Zoom Security Bulletin for vendor-published details.

Workarounds

Where immediate Zoom client updates are not possible, update the Microsoft Edge WebView2 Runtime to 109.0.1481.0 or later and restart all Zoom processes.
Restrict outbound network access from Zoom processes to Microsoft Spellcheck telemetry endpoints at the egress proxy or firewall until clients are patched.
Instruct users to avoid pasting sensitive content into Zoom chat or input fields on unpatched Windows hosts.

bash

# Verify installed Zoom and WebView2 versions on Windows
Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* `
  | Where-Object { $_.DisplayName -like "*Zoom*" -or $_.DisplayName -like "*WebView2*" } `
  | Select-Object DisplayName, DisplayVersion