---
id: 5567
title: "Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307"
cve: CVE-2026-6307
cvss: 8.8
severity: high
source_domain: nebusec.ai
source_url: "https://nebusec.ai/research/v8-cve-2026-6307-writeup/"
published_at: "2026-06-29T00:00:00Z"
tags: ["rce", "vulnerability-research", "browser-security", "jit", "sandbox-escape", "v8", "chrome", "nebusec", "cve-2026-6307"]
phying_url: "https://phying.com/item/5567"
lang: en
---

# Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307

## Summary

NebuSec details CVE-2026-6307 (Longinus): a single V8 TurboFan bug yields arbitrary read/write in the heap sandbox and escapes it to write outside, piercing Chrome's renderer.

## Intelligence Metadata

- **Sources:** nebusec.ai
- **CVE:** CVE-2026-6307
- **CVSS:** 8.8
- **Published:** 2026-06-29T00:00:00Z
- **Original:** https://nebusec.ai/research/v8-cve-2026-6307-writeup/
- **Phying News:** https://phying.com/item/5567