Have a search for V8 RCE/CVEs over the past year.

That's why I mentioned vendors. They patch it before announcements.

Also, sandboxing makes automatic exploitation harder. There is no FS persistence, so some checks simply do not pass.