Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
Summary
Nebula Security presents CVE-2026-6307, a V8/Chrome vulnerability that enables arbitrary read/write inside the V8 heap sandbox and sandbox escape. The writeup details how a single bug can cause two distinct frame-states to be merged, enabling addrof and fakeobj primitives, and outlines exploitation steps and mitigations. It also covers TurboFan inlining, JS-to-Wasm interactions, and the patch timeline for Chrome.