Author: Nebula Security
Published: June 29, 2026
Source: https://nebusec.ai/research/v8-cve-2026-6307-writeup/
Summary
Nebula Security published a technical writeup, dubbed “Longinus,” of CVE-2026-6307, a high-severity flaw in Google Chrome’s V8 JavaScript engine. The bug lives in the TurboFan JIT compiler and is notable because a single vulnerability crosses two security boundaries at once: it yields a stable arbitrary read/write primitive inside the renderer and, on its own, escapes the V8 heap sandbox to reach remote code execution — without chaining a second bug and without any heap-spraying tricks. According to the researchers the exploit achieves a 100% success rate. The issue affects Chrome 106 through 147 (roughly four years of releases) and was fixed in Chrome 147.0.7727.101.
Technical Details
The root cause is an incorrect equality comparison for FrameStateFunctionInfo objects. When TurboFan evaluated whether two JSToWasmFrameStateFunctionInfo objects were equivalent, the equality operator accepted references to the base class and compared only the fields defined on that base class. Crucially, it never compared the WebAssembly function signatures. As a result, common subexpression elimination (CSE) could incorrectly merge deoptimization metadata belonging to functions that share an identical parameter list but differ in return type — for example an i64 return versus an externref (a tagged JavaScript object reference). By exploiting this signature-merging confusion and then triggering a lazy deoptimization during execution, an attacker forces the deoptimizer to materialize a value under the wrong type, treating a raw integer as an object reference and vice versa. This yields the classic addrof primitive (leaking a tagged pointer as an integer) and fakeobj primitive (treating an attacker-controlled integer as an object).
Impact
With addrof/fakeobj in hand, the attacker forges object pointers backed by valid maps that point outside the sandbox, then abuses in-object property stores to write arbitrary data to locations beyond the V8 heap sandbox. Per the writeup this delivers a full arbitrary memory read/write primitive with a reported 100% success rate and no spraying required, and — unusually — achieves a V8 heap sandbox escape and RCE from this one bug alone, rather than requiring a separate sandbox-escape vulnerability. The final step patches JIT-managed memory regions to gain code execution in the Chrome renderer. Because the flaw was reachable from Chrome 106 onward, a broad range of installations were exposed until patched.
Mitigation
Google fixed the issue in Chrome 147.0.7727.101 (released April 7, 2026). The patch modifies the equality comparison operator so that it explicitly compares the WebAssembly signatures when evaluating JSToWasmFrameStateFunctionInfo objects, and adds static assertions intended to catch similar field-omission mistakes in future changes. Users and administrators should update Chrome to the latest version; no other workaround is described in the source.