{"vulnerability": "CVE-2026-6307", "sightings": [{"uuid": "24e5c8c6-4911-4f8a-b6bf-44f3330e3865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjkvg6qnoi2w", "content": "", "creation_timestamp": "2026-04-15T22:00:34.398959Z"}, {"uuid": "78377d6c-bc62-4867-b7fd-ae11f75b00ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260416", "content": "", "creation_timestamp": "2026-04-15T18:00:00.000000Z"}, {"uuid": "d5dac2b4-4a4a-4f68-b453-bba43b929751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpiy6ny752m", "content": "", "creation_timestamp": "2026-04-17T18:01:18.851697Z"}, {"uuid": "0aba06c3-007a-4284-bc3a-c094ce8304da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260420", "content": "", "creation_timestamp": "2026-04-19T20:00:00.000000Z"}, {"uuid": "c9f5480f-b64d-4056-b847-bfd8d94409dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "published-proof-of-concept", "source": "Telegram/0zmBng2ph0j5-h51LqidOz9H-G3O8PUZqZfxER_d38YEET8", "content": "", "creation_timestamp": "2026-04-15T23:26:54.000000Z"}, {"uuid": "1b27350f-2265-447d-a3f1-669151503480", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/chromeos-multiple-vulnerabilities_20260428", "content": "", "creation_timestamp": "2026-04-27T20:00:00.000000Z"}, {"uuid": "6065eaa8-25ab-47bc-96e0-a9400747d40c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnpxs5xii22i", "content": "\ud83d\udccc CVE-2026-6307 - Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted... https://www.cyberhub.blog/cves/CVE-2026-6307", "creation_timestamp": "2026-06-07T20:07:08.651076Z"}, {"uuid": "59bd3b67-c325-43ff-a53a-0678f75e3ea0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mpgr3yiled2w", "content": "Longinus: 2 Boundaries in One Bug, Piercing Chrome\u2019s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307\nDiscussion | lobsters | Author: devgianlu", "creation_timestamp": "2026-06-29T15:03:56.452339Z"}, {"uuid": "19b4d787-e6c9-41a9-8316-68bae0cf6432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mpgt4u7af42m", "content": "Longinus: 2 Boundaries in One Bug, Piercing Chrome\u2019s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307 https://lobste.rs/s/uaoe9y #security #web ", "creation_timestamp": "2026-06-29T15:40:04.714735Z"}, {"uuid": "809d9f47-d3e0-49a6-9ab9-317744dbacba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mph3brnxew25", "content": "\ud83d\udd12 Longinus: 2 Boundaries in One Bug, Piercing Chrome\u2019s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307\n\nNebula Security Research identified \"Longinus\" (CVE-2026-6...\n\nhttps://tinyurl.com/246rwbrx #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-06-29T18:05:59.438179Z"}, {"uuid": "b3fd604a-1aa2-4837-b20f-8d30034212f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://bsky.app/profile/foursignalsdev.bsky.social/post/3mpjvibwvf22t", "content": "CVE-2026-6307: one V8 bug in Chrome\u2019s TurboFan JIT gives both heap read/write and sandbox escape. Present since Chrome 106, it exploits incorrect deopt metadata in JS-to-Wasm inlining. Patch now\u2014this single flaw bypasses V8\u2019s sandbox, a\u2026", "creation_timestamp": "2026-06-30T21:00:15.106889Z"}, {"uuid": "c753522f-afc1-4452-8c8b-0efd9087b452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://t.me/brutsecurity/2777", "content": "\ud83d\udd25 Chrome RCE PoC: CVE-2026-6307\n\nA working renderer RCE Proof of Concept for CVE-2026-6307 \u2014 a V8 type-confusion bug (JS-to-Wasm deoptimization) patched in Chrome 147.0.7727.101.\n\n\u2705 Full primitives (addrof/fakeobj, out-of-cage, in-cage r/w)  \n\u2705 No-ASLR RCE that patches JIT code to pop xcalc  \n\u2705 Based on Nebula Security writeup  \n\u2705 Heavily improved with frontier LLMs + human direction (4-day experiment)\n\nThis is renderer-only and still far from fully weaponized, but great for learning and research.\n\n\ud83d\udce5 PoC + scripts:  \nhttps://github.com/0xsha/CVE-2026-6307\n\n#Chrome #V8 #Exploit #CVE #SecurityResearch", "creation_timestamp": "2026-07-09T03:00:04.592434Z"}, {"uuid": "63e385e3-4208-4ddc-a0a5-665dee84acbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6307", "type": "seen", "source": "https://t.me/brutsecurity/2777", "content": "\ud83d\udd25 Chrome RCE PoC: CVE-2026-6307\n\nA working renderer RCE Proof of Concept for CVE-2026-6307 \u2014 a V8 type-confusion bug (JS-to-Wasm deoptimization) patched in Chrome 147.0.7727.101.\n\n\u2705 Full primitives (addrof/fakeobj, out-of-cage, in-cage r/w)  \n\u2705 No-ASLR RCE that patches JIT code to pop xcalc  \n\u2705 Based on Nebula Security writeup  \n\u2705 Heavily improved with frontier LLMs + human direction (4-day experiment)\n\nThis is renderer-only and still far from fully weaponized, but great for learning and research.\n\n\ud83d\udce5 PoC + scripts:  \nhttps://github.com/0xsha/CVE-2026-6307\n\n#Chrome #V8 #Exploit #CVE #SecurityResearch", "creation_timestamp": "2026-07-10T00:00:11.678919Z"}]}