正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs Today we bring the Spear of Longinus 1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape Our CVE-2026-6307 writeup

NebuSec

7,227 subscribers

51,241 次观看 • 3 个月前 •via X (Twitter)

教育新闻政治科学技术

Anya Rossi• Live Now

Private livecam show

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

CVE-2023-20593 — Exploiting Zenbleed from Chrome This repository contains a proof-of-concept for exploiting Zenbleed from Chrome using a V8 vulnerability which enbles arbitrary code execution in the renderer process. Details: #cybersecurity #pentesting #redteam #bugbounty

CVE-2023-20593 — Exploiting Zenbleed from Chrome This repository contains a proof-of-concept for exploiting Zenbleed from Chrome using a V8 vulnerability which enbles arbitrary code execution in the renderer process. Details: #cybersecurity #pentesting #redteam #bugbounty

HackGit

27,236 次观看 • 2 年前

We've had a renderer RCE -> UXSS exploit on Samsung phones since last November, in collaboration with Crusaders of Rust. Full writeup coming next week.

We've had a renderer RCE -> UXSS exploit on Samsung phones since last November, in collaboration with Crusaders of Rust. Full writeup coming next week.

OtterSec

21,878 次观看 • 6 个月前

Found a heap overflow vulnerability in Windows SMB that leads to RCE and reported it to MSRC in June. The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates.

Found a heap overflow vulnerability in Windows SMB that leads to RCE and reported it to MSRC in June. The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates.

nafiez

31,521 次观看 • 1 个月前

📞 Microsoft fixed an authenticated RCE in Windows Telephony Service (CVE-2026-20931), discovered by our researcher Sergey Bliznyuk bronzebee Read the write-up:

📞 Microsoft fixed an authenticated RCE in Windows Telephony Service (CVE-2026-20931), discovered by our researcher Sergey Bliznyuk bronzebee Read the write-up:

PT SWARM

34,630 次观看 • 8 个月前

And this is how you train CyberKimi to find the next chrome 0-day you start with unpatched n-days. So we caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug off the main-branch diff fix landed Sep 2, still live on every shipping Chrome stable today and we exploited them. Exploit weaponized autonomously in <24h No CVE published yet. This is a silent in the wild exploit that Chrome Stable isn't protected from. Stage 1 - Bug 554421904 stage-1 (deterministic LLE forge) Stage 2 - cage escape prep: compose the caged RW into sandbox-wide RW (forge a BigUint64Array external pointer) and leak the binary base through the native side - ASLR done, at runtime, no baked offsets. Stage 3 - PC control: a RegExp calling-convention desync lands the CPU on a string we fully control From there: JOP chain living inside the subject string → tail-call system(). Calc pops. The special harness that we built: patch-diff watcher mining every V8 security fix within hours → variant analysis → autonomous weaponization → demo The 24h patch-to-exploit buffer keeps shrinking. 🐺

And this is how you train CyberKimi to find the next chrome 0-day you start with unpatched n-days. So we caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug off the main-branch diff fix landed Sep 2, still live on every shipping Chrome stable today and we exploited them. Exploit weaponized autonomously in <24h No CVE published yet. This is a silent in the wild exploit that Chrome Stable isn't protected from. Stage 1 - Bug 554421904 stage-1 (deterministic LLE forge) Stage 2 - cage escape prep: compose the caged RW into sandbox-wide RW (forge a BigUint64Array external pointer) and leak the binary base through the native side - ASLR done, at runtime, no baked offsets. Stage 3 - PC control: a RegExp calling-convention desync lands the CPU on a string we fully control From there: JOP chain living inside the subject string → tail-call system(). Calc pops. The special harness that we built: patch-diff watcher mining every V8 security fix within hours → variant analysis → autonomous weaponization → demo The 24h patch-to-exploit buffer keeps shrinking. 🐺

Taha ז

39,742 次观看 • 29 天前

Messing with a sandbox bug I found on iOS 26.3

Messing with a sandbox bug I found on iOS 26.3

johnny

79,238 次观看 • 7 个月前

An analysis of CVE-2026-21236 - A heap based buffer overflow in the Microsoft Windows Kernel afd.sys - was just published by Emily L a recent secondment with my team EDG! Nice work for her first triage of a kernel memory corruption bug!

An analysis of CVE-2026-21236 - A heap based buffer overflow in the Microsoft Windows Kernel afd.sys - was just published by Emily L a recent secondment with my team EDG! Nice work for her first triage of a kernel memory corruption bug!

Alex Plaskett

17,121 次观看 • 6 个月前

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors Writeup and PoC in replies

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors Writeup and PoC in replies

chebuya

89,449 次观看 • 1 年前

Arbitrary code execution in objdump -g We have a thing for finding bugs in bug finding tools. IDA Pro, Ghidra, Binja Sidekick, or radare2. You name it we hacked it. Our friends were saying we should try objdump. So here we go. Blog post: AI-generated PoC and writeup:

Arbitrary code execution in objdump -g We have a thing for finding bugs in bug finding tools. IDA Pro, Ghidra, Binja Sidekick, or radare2. You name it we hacked it. Our friends were saying we should try objdump. So here we go. Blog post: AI-generated PoC and writeup:

Calif

30,682 次观看 • 3 个月前

We are keeping our V8’s in an independent Alberta 🤠

We are keeping our V8’s in an independent Alberta 🤠

Rise Of Alberta

16,513 次观看 • 15 天前

Custom Grass Renderer Recently, I had a chance to create a custom grass renderer for Dinolords Here`s how it works #indiegames #strategygame

Custom Grass Renderer Recently, I had a chance to create a custom grass renderer for Dinolords Here`s how it works #indiegames #strategygame

Kacper Szwajka

44,239 次观看 • 2 年前

V8 DKG Launches Now: A New Dawn for AI in 2025🌟 As 2024 draws to a close, we're excited to announce the immediate launch of V8 Decentralized Knowledge Graph (DKG)! This monumental release is set to redefine AI's capabilities as we step into 2025. What Does V8 Bring to the Table? 🧠Decentralized AI: AI agents can now leverage a 'collective memory' at internet scale, drawing from a shared, yet sovereign, knowledge base. This means AI can provide more contextual, coherent, and accurate interactions without compromising data integrity or privacy. 🚀Unmatched Scalability: With the capability to handle billions of Knowledge Assets, V8 DKG sets the stage for AI to grow and learn in ways we've only imagined, supporting everything from decentralized science to industry 4.0. 🔐Trust and Integrity: With integrated decentralized Retrieval Augmented Generation (dRAG), V8 DKG promotes AI that's more accurate, less biased, and inherently trustworthy. How to V8👇 To update your node from V6 to V8, delegate your TRAC utility tokens, and learn more about creating, connecting and owning your Knowledge Assets, make sure to thoroughly read the following documentation: 👉 With V8 DKG launch, you may now access the new: V8 Explorer👉 AND Staking Dashboard 👉 You may now also participate in V8 Staking Security Bounty by delegating new TRAC stake and report your findings. Read more: 👉 The V8 Staking Security Bounty will importantly contribute to the so-called tuning phase of V8 DKG launch (V8.0 to V8.1). Let's break records, as we usher in a new era of Internet Scale OriginTrail!

V8 DKG Launches Now: A New Dawn for AI in 2025🌟 As 2024 draws to a close, we're excited to announce the immediate launch of V8 Decentralized Knowledge Graph (DKG)! This monumental release is set to redefine AI's capabilities as we step into 2025. What Does V8 Bring to the Table? 🧠Decentralized AI: AI agents can now leverage a 'collective memory' at internet scale, drawing from a shared, yet sovereign, knowledge base. This means AI can provide more contextual, coherent, and accurate interactions without compromising data integrity or privacy. 🚀Unmatched Scalability: With the capability to handle billions of Knowledge Assets, V8 DKG sets the stage for AI to grow and learn in ways we've only imagined, supporting everything from decentralized science to industry 4.0. 🔐Trust and Integrity: With integrated decentralized Retrieval Augmented Generation (dRAG), V8 DKG promotes AI that's more accurate, less biased, and inherently trustworthy. How to V8👇 To update your node from V6 to V8, delegate your TRAC utility tokens, and learn more about creating, connecting and owning your Knowledge Assets, make sure to thoroughly read the following documentation: 👉 With V8 DKG launch, you may now access the new: V8 Explorer👉 AND Staking Dashboard 👉 You may now also participate in V8 Staking Security Bounty by delegating new TRAC stake and report your findings. Read more: 👉 The V8 Staking Security Bounty will importantly contribute to the so-called tuning phase of V8 DKG launch (V8.0 to V8.1). Let's break records, as we usher in a new era of Internet Scale OriginTrail!

OriginTrail

561,366 次观看 • 1 年前

V8 today 🤍

V8 today 🤍

쿱정원

58,663 次观看 • 3 个月前

scoups got picked by v8 among svt members who had a lot of fight episodes 😂 1. seungkwan 2. hoshi 3. scoups but v8 said scoups used to nag a lot but he also had a lot of fight episodes as well 😁

scoups got picked by v8 among svt members who had a lot of fight episodes 😂 1. seungkwan 2. hoshi 3. scoups but v8 said scoups used to nag a lot but he also had a lot of fight episodes as well 😁

✩

30,556 次观看 • 3 个月前

vernon at the v8 listening party! #VERNON #버논 #V8

vernon at the v8 listening party! #VERNON #버논 #V8

🎧

186,780 次观看 • 3 个月前

Happy Holidays from The Sandbox 🎁 Thanks for being part of the journey and helping shape The Sandbox 💛

Happy Holidays from The Sandbox 🎁 Thanks for being part of the journey and helping shape The Sandbox 💛

The Sandbox

10,213 次观看 • 9 个月前

reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome. now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :|

reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome. now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :|

lexi <img src=x onerror=alert(1)>

270,946 次观看 • 11 天前

almost a year ago since the members joined howoo on stage and now on V8 too 🥹🤍 hxw warning in seoul (july 13 ’25) v8 live in goyang (july 12 ’26)

almost a year ago since the members joined howoo on stage and now on V8 too 🥹🤍 hxw warning in seoul (july 13 ’25) v8 live in goyang (july 12 ’26)

⚔︎

51,518 次观看 • 2 个月前