Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs Today we bring the Spear of Longinus 1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape Our CVE-2026-6307 writeup

NebuSec

7,227 subscribers

51,241 views • 3 months ago •via X (Twitter)

Education News & Politics Science & Technology

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

CVE-2023-20593 — Exploiting Zenbleed from Chrome This repository contains a proof-of-concept for exploiting Zenbleed from Chrome using a V8 vulnerability which enbles arbitrary code execution in the renderer process. Details: #cybersecurity #pentesting #redteam #bugbounty

CVE-2023-20593 — Exploiting Zenbleed from Chrome This repository contains a proof-of-concept for exploiting Zenbleed from Chrome using a V8 vulnerability which enbles arbitrary code execution in the renderer process. Details: #cybersecurity #pentesting #redteam #bugbounty

HackGit

27,236 views • 2 years ago

We've had a renderer RCE -> UXSS exploit on Samsung phones since last November, in collaboration with Crusaders of Rust. Full writeup coming next week.

We've had a renderer RCE -> UXSS exploit on Samsung phones since last November, in collaboration with Crusaders of Rust. Full writeup coming next week.

OtterSec

21,878 views • 6 months ago

Found a heap overflow vulnerability in Windows SMB that leads to RCE and reported it to MSRC in June. The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates.

Found a heap overflow vulnerability in Windows SMB that leads to RCE and reported it to MSRC in June. The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates.

nafiez

31,521 views • 1 month ago

📞 Microsoft fixed an authenticated RCE in Windows Telephony Service (CVE-2026-20931), discovered by our researcher Sergey Bliznyuk bronzebee Read the write-up:

📞 Microsoft fixed an authenticated RCE in Windows Telephony Service (CVE-2026-20931), discovered by our researcher Sergey Bliznyuk bronzebee Read the write-up:

PT SWARM

34,630 views • 8 months ago

And this is how you train CyberKimi to find the next chrome 0-day you start with unpatched n-days. So we caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug off the main-branch diff fix landed Sep 2, still live on every shipping Chrome stable today and we exploited them. Exploit weaponized autonomously in <24h No CVE published yet. This is a silent in the wild exploit that Chrome Stable isn't protected from. Stage 1 - Bug 554421904 stage-1 (deterministic LLE forge) Stage 2 - cage escape prep: compose the caged RW into sandbox-wide RW (forge a BigUint64Array external pointer) and leak the binary base through the native side - ASLR done, at runtime, no baked offsets. Stage 3 - PC control: a RegExp calling-convention desync lands the CPU on a string we fully control From there: JOP chain living inside the subject string → tail-call system(). Calc pops. The special harness that we built: patch-diff watcher mining every V8 security fix within hours → variant analysis → autonomous weaponization → demo The 24h patch-to-exploit buffer keeps shrinking. 🐺

And this is how you train CyberKimi to find the next chrome 0-day you start with unpatched n-days. So we caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug off the main-branch diff fix landed Sep 2, still live on every shipping Chrome stable today and we exploited them. Exploit weaponized autonomously in <24h No CVE published yet. This is a silent in the wild exploit that Chrome Stable isn't protected from. Stage 1 - Bug 554421904 stage-1 (deterministic LLE forge) Stage 2 - cage escape prep: compose the caged RW into sandbox-wide RW (forge a BigUint64Array external pointer) and leak the binary base through the native side - ASLR done, at runtime, no baked offsets. Stage 3 - PC control: a RegExp calling-convention desync lands the CPU on a string we fully control From there: JOP chain living inside the subject string → tail-call system(). Calc pops. The special harness that we built: patch-diff watcher mining every V8 security fix within hours → variant analysis → autonomous weaponization → demo The 24h patch-to-exploit buffer keeps shrinking. 🐺

Taha ז

39,742 views • 29 days ago

Messing with a sandbox bug I found on iOS 26.3

Messing with a sandbox bug I found on iOS 26.3

johnny

79,238 views • 7 months ago

An analysis of CVE-2026-21236 - A heap based buffer overflow in the Microsoft Windows Kernel afd.sys - was just published by Emily L a recent secondment with my team EDG! Nice work for her first triage of a kernel memory corruption bug!

An analysis of CVE-2026-21236 - A heap based buffer overflow in the Microsoft Windows Kernel afd.sys - was just published by Emily L a recent secondment with my team EDG! Nice work for her first triage of a kernel memory corruption bug!

Alex Plaskett

17,121 views • 6 months ago

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors Writeup and PoC in replies

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors Writeup and PoC in replies

chebuya

89,449 views • 1 year ago

Arbitrary code execution in objdump -g We have a thing for finding bugs in bug finding tools. IDA Pro, Ghidra, Binja Sidekick, or radare2. You name it we hacked it. Our friends were saying we should try objdump. So here we go. Blog post: AI-generated PoC and writeup:

Arbitrary code execution in objdump -g We have a thing for finding bugs in bug finding tools. IDA Pro, Ghidra, Binja Sidekick, or radare2. You name it we hacked it. Our friends were saying we should try objdump. So here we go. Blog post: AI-generated PoC and writeup:

Calif

30,682 views • 3 months ago

We are keeping our V8’s in an independent Alberta 🤠

We are keeping our V8’s in an independent Alberta 🤠

Rise Of Alberta

16,513 views • 15 days ago

Custom Grass Renderer Recently, I had a chance to create a custom grass renderer for Dinolords Here`s how it works #indiegames #strategygame

Custom Grass Renderer Recently, I had a chance to create a custom grass renderer for Dinolords Here`s how it works #indiegames #strategygame

Kacper Szwajka

44,239 views • 2 years ago

V8 DKG Launches Now: A New Dawn for AI in 2025🌟 As 2024 draws to a close, we're excited to announce the immediate launch of V8 Decentralized Knowledge Graph (DKG)! This monumental release is set to redefine AI's capabilities as we step into 2025. What Does V8 Bring to the Table? 🧠Decentralized AI: AI agents can now leverage a 'collective memory' at internet scale, drawing from a shared, yet sovereign, knowledge base. This means AI can provide more contextual, coherent, and accurate interactions without compromising data integrity or privacy. 🚀Unmatched Scalability: With the capability to handle billions of Knowledge Assets, V8 DKG sets the stage for AI to grow and learn in ways we've only imagined, supporting everything from decentralized science to industry 4.0. 🔐Trust and Integrity: With integrated decentralized Retrieval Augmented Generation (dRAG), V8 DKG promotes AI that's more accurate, less biased, and inherently trustworthy. How to V8👇 To update your node from V6 to V8, delegate your TRAC utility tokens, and learn more about creating, connecting and owning your Knowledge Assets, make sure to thoroughly read the following documentation: 👉 With V8 DKG launch, you may now access the new: V8 Explorer👉 AND Staking Dashboard 👉 You may now also participate in V8 Staking Security Bounty by delegating new TRAC stake and report your findings. Read more: 👉 The V8 Staking Security Bounty will importantly contribute to the so-called tuning phase of V8 DKG launch (V8.0 to V8.1). Let's break records, as we usher in a new era of Internet Scale OriginTrail!

V8 DKG Launches Now: A New Dawn for AI in 2025🌟 As 2024 draws to a close, we're excited to announce the immediate launch of V8 Decentralized Knowledge Graph (DKG)! This monumental release is set to redefine AI's capabilities as we step into 2025. What Does V8 Bring to the Table? 🧠Decentralized AI: AI agents can now leverage a 'collective memory' at internet scale, drawing from a shared, yet sovereign, knowledge base. This means AI can provide more contextual, coherent, and accurate interactions without compromising data integrity or privacy. 🚀Unmatched Scalability: With the capability to handle billions of Knowledge Assets, V8 DKG sets the stage for AI to grow and learn in ways we've only imagined, supporting everything from decentralized science to industry 4.0. 🔐Trust and Integrity: With integrated decentralized Retrieval Augmented Generation (dRAG), V8 DKG promotes AI that's more accurate, less biased, and inherently trustworthy. How to V8👇 To update your node from V6 to V8, delegate your TRAC utility tokens, and learn more about creating, connecting and owning your Knowledge Assets, make sure to thoroughly read the following documentation: 👉 With V8 DKG launch, you may now access the new: V8 Explorer👉 AND Staking Dashboard 👉 You may now also participate in V8 Staking Security Bounty by delegating new TRAC stake and report your findings. Read more: 👉 The V8 Staking Security Bounty will importantly contribute to the so-called tuning phase of V8 DKG launch (V8.0 to V8.1). Let's break records, as we usher in a new era of Internet Scale OriginTrail!

OriginTrail

561,366 views • 1 year ago

V8 today 🤍

V8 today 🤍

쿱정원

58,663 views • 3 months ago

scoups got picked by v8 among svt members who had a lot of fight episodes 😂 1. seungkwan 2. hoshi 3. scoups but v8 said scoups used to nag a lot but he also had a lot of fight episodes as well 😁

scoups got picked by v8 among svt members who had a lot of fight episodes 😂 1. seungkwan 2. hoshi 3. scoups but v8 said scoups used to nag a lot but he also had a lot of fight episodes as well 😁

✩

30,556 views • 3 months ago

vernon at the v8 listening party! #VERNON #버논 #V8

vernon at the v8 listening party! #VERNON #버논 #V8

🎧

186,780 views • 3 months ago

Happy Holidays from The Sandbox 🎁 Thanks for being part of the journey and helping shape The Sandbox 💛

Happy Holidays from The Sandbox 🎁 Thanks for being part of the journey and helping shape The Sandbox 💛

The Sandbox

10,213 views • 9 months ago

reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome. now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :|

reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome. now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :|

lexi <img src=x onerror=alert(1)>

270,946 views • 11 days ago

almost a year ago since the members joined howoo on stage and now on V8 too 🥹🤍 hxw warning in seoul (july 13 ’25) v8 live in goyang (july 12 ’26)

almost a year ago since the members joined howoo on stage and now on V8 too 🥹🤍 hxw warning in seoul (july 13 ’25) v8 live in goyang (july 12 ’26)

⚔︎

51,518 views • 2 months ago