CVE-2026-6307-Longinus

Type Confusion in V8 TurboFan (JS-to-Wasm call inlining + FrameState merging)

Better Known as 'Longinus': 2 Boundaries in One Bug

Repository: https://github.com/J4ck3LSyN-Gen2/CVE-2026-6307-Longinus
Detailed Report: OS-IS-CVE-2026-6307-07-2026.md
Technical Write-up: Nebula Security - Longinus: 2 Boundaries in One Bug

[!WARNING] This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets.

• This exploit demonstrates a critical remote code execution (RCE) vulnerability (CVE-2026-6307) that can fully compromise the Chrome renderer sandbox.
• Running or hosting this code may trigger antivirus detections, security monitoring alerts, or legal consequences if misused.
• The authors and repository maintainers assume no liability for any damage, misuse, or illegal activity resulting from this code.
• Use exclusively in isolated lab environments with proper authorization. Intended for defensive research, vulnerability analysis, and blue-team testing only.

Overview

This repository contains a Proof-of-Concept (PoC) for CVE-2026-6307 ("Longinus"), a high-severity type confusion vulnerability in Google V8's TurboFan compiler. The bug arises from an incomplete equality comparison in FrameStateFunctionInfo during JS-to-WebAssembly call inlining, specifically omitting the signature_ field of JSToWasmFrameStateFunctionInfo.

This flaw enables incorrect merging of FrameState nodes with differing return types (externref vs i64). During lazy deoptimization, the deoptimizer misinterprets return registers, yielding powerful arbitrary read/write primitives:

• addrof(target) - Leak the address of a JavaScript object as a BigInt.
• fakeobj(addr) - Materialize a fake JavaScript object at an arbitrary address.

These primitives pierce both the V8 heap sandbox and renderer sandbox boundaries in a single vulnerability when combined with appropriate follow-on techniques.

Impact: Remote Code Execution (RCE) inside the sandboxed renderer process via malicious JavaScript (e.g., a crafted webpage).

Vulnerability Root Cause (Technical Summary)

1. JS-to-Wasm Inlining in TurboFan creates FrameState nodes that embed JSToWasmFrameStateFunctionInfo.
2. The equality operator (==) for FrameStateFunctionInfo does not compare the WebAssembly function signature (signature_).
3. Common Subexpression Elimination (CSE) merges FrameStates with mismatched return kinds.
4. On deoptimization:
   • externref misinterpreted as i64 → pointer bits leaked as BigInt (addrof).
   • i64 misinterpreted as externref → integer bits materialized as tagged reference (fakeobj).

See the full Nebula Security write-up and the attached analysis report for diagrams, TurboFan IR snippets, and deoptimizer behavior.

Repository Contents

Setup & Usage

Requirements

• Vulnerable V8 build (pre-fix, e.g., Chrome < 147.0.7727.101 or matching d8 binary from around March–June 2026).
• V8 flags: --allow-natives-syntax --expose-wasm
• Recommended: Debug d8 with --turbo-dynamic-map-checks or similar for debugging.

Running the PoC

# Using d8 shell
./d8 --allow-natives-syntax --expose-wasm poc.js

Expected Behavior (on vulnerable build):

• Successful addrof leak of a dummy object.
• Successful fakeobj materialization (identity check passes).
• Basic arbitrary read demonstration via ArrayBuffer backing store.

Note: Full RCE requires additional engineering (offset calculation, WASM/GC interaction, sandbox escape). This PoC focuses on the core primitives.

YARA Detection

The included .yar rule can be used in security tooling to identify the PoC pattern in scripts or memory.

Mitigation

• Update immediately to Chrome/V8 versions ≥ 147.0.7727.101 (or the patched release containing the fix).
• Enable Control Flow Integrity (CFI).
• Leverage Site Isolation (default in modern Chrome).
• Use strong sandboxing, CSP, and keep systems fully patched.

References & Credits

• Primary Write-up: Nebula Security - Longinus
• Detailed Analysis Report: OS-IS-CVE-2026-6307-07-2026.md
• Original research credited to Vega (Nebula Security) and contributors.
• Thanks to the V8 team for the rapid response and fix.
• Thank to YogSoth0 for the relative info.

Disclaimer: This repository is provided for educational, defensive, and research purposes only. Do not use on unauthorized systems. The authors assume no liability for misuse.

For questions, contributions, or variant development, open an issue or PR.

Last updated: July 2026