Since V8 had heap sandbox, Chrome renderer RCE usually... means chaining 2 bugs Today we bring the Spear of Longinus 1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape Our CVE-2026-6307 writeupshow more

CVE-2023-20593 — Exploiting Zenbleed from Chrome This repository contains... a proof-of-concept for exploiting Zenbleed from Chrome using a V8 vulnerability which enbles arbitrary code execution in the renderer process. Details: #cybersecurity #pentesting #redteam #bugbountyshow more

We've had a renderer RCE -> UXSS exploit on... Samsung phones since last November, in collaboration with Crusaders of Rust. Full writeup coming next week.show more

Found a heap overflow vulnerability in Windows SMB that... leads to RCE and reported it to MSRC in June. The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates.show more

📞 Microsoft fixed an authenticated RCE in Windows Telephony... Service (CVE-2026-20931), discovered by our researcher Sergey Bliznyuk bronzebee Read the write-up:show more

And this is how you train CyberKimi to find... the next chrome 0-day you start with unpatched n-days. So we caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug off the main-branch diff fix landed Sep 2, still live on every shipping Chrome stable today and we exploited them. Exploit weaponized autonomously in <24h No CVE published yet. This is a silent in the wild exploit that Chrome Stable isn't protected from. Stage 1 - Bug 554421904 stage-1 (deterministic LLE forge) Stage 2 - cage escape prep: compose the caged RW into sandbox-wide RW (forge a BigUint64Array external pointer) and leak the binary base through the native side - ASLR done, at runtime, no baked offsets. Stage 3 - PC control: a RegExp calling-convention desync lands the CPU on a string we fully control From there: JOP chain living inside the subject string → tail-call system(). Calc pops. The special harness that we built: patch-diff watcher mining every V8 security fix within hours → variant analysis → autonomous weaponization → demo The 24h patch-to-exploit buffer keeps shrinking. 🐺show more

Messing with a sandbox bug I found on iOS 26.3

An analysis of CVE-2026-21236 - A heap based buffer... overflow in the Microsoft Windows Kernel afd.sys - was just published by Emily L a recent secondment with my team EDG! Nice work for her first triage of a kernel memory corruption bug!show more

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an... attacker to read and write TCP traffic through affected teamservers. Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors Writeup and PoC in repliesshow more

Arbitrary code execution in objdump -g We have a... thing for finding bugs in bug finding tools. IDA Pro, Ghidra, Binja Sidekick, or radare2. You name it we hacked it. Our friends were saying we should try objdump. So here we go. Blog post: AI-generated PoC and writeup:show more

V8 DKG Launches Now: A New Dawn for AI... in 2025🌟 As 2024 draws to a close, we're excited to announce the immediate launch of V8 Decentralized Knowledge Graph (DKG)! This monumental release is set to redefine AI's capabilities as we step into 2025. What Does V8 Bring to the Table? 🧠Decentralized AI: AI agents can now leverage a 'collective memory' at internet scale, drawing from a shared, yet sovereign, knowledge base. This means AI can provide more contextual, coherent, and accurate interactions without compromising data integrity or privacy. 🚀Unmatched Scalability: With the capability to handle billions of Knowledge Assets, V8 DKG sets the stage for AI to grow and learn in ways we've only imagined, supporting everything from decentralized science to industry 4.0. 🔐Trust and Integrity: With integrated decentralized Retrieval Augmented Generation (dRAG), V8 DKG promotes AI that's more accurate, less biased, and inherently trustworthy. How to V8👇 To update your node from V6 to V8, delegate your TRAC utility tokens, and learn more about creating, connecting and owning your Knowledge Assets, make sure to thoroughly read the following documentation: 👉 With V8 DKG launch, you may now access the new: V8 Explorer👉 AND Staking Dashboard 👉 You may now also participate in V8 Staking Security Bounty by delegating new TRAC stake and report your findings. Read more: 👉 The V8 Staking Security Bounty will importantly contribute to the so-called tuning phase of V8 DKG launch (V8.0 to V8.1). Let's break records, as we usher in a new era of Internet Scale OriginTrail!show more

Custom Grass Renderer Recently, I had a chance to... create a custom grass renderer for Dinolords Here`s how it works #indiegames #strategygameshow more

V8 today 🤍

scoups got picked by v8 among svt members who... had a lot of fight episodes 😂 1. seungkwan 2. hoshi 3. scoups but v8 said scoups used to nag a lot but he also had a lot of fight episodes as well 😁show more

Happy Holidays from The Sandbox 🎁 Thanks for being... part of the journey and helping shape The Sandbox 💛show more

vernon at the v8 listening party! #VERNON #버논 #V8

almost a year ago since the members joined howoo... on stage and now on V8 too 🥹🤍 hxw warning in seoul (july 13 ’25) v8 live in goyang (july 12 ’26)show more

🌐 Enter Lens Legacy in The Sandbox, an NFT... gallery designed by and Metatheory. Step into a world of rare NFTs and explore the metaverse like never before! 🎨✨ seed.photo The Sandbox Metatheory Studio @cashclickapp #SeedPhoto #Sandbox #Metatheory #NFT #Metaverseshow more

Signal's Contact Discovery automatically sends your contact list information... to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. 🧵show more