News Vulnerabilities & Zero-Days

XBOW used a public OpenAI model to build a $250,000 Chrome exploit chain in six days

Security firm XBOW says AI agents running OpenAI's publicly available GPT-5.6 Sol model helped its researchers build a three-bug Chrome exploit chain in six days, earning a $250,000 Google bounty. All three bugs are now fixed.

Published Updated
Illustration of three glowing chain links breaking open a browser window sandbox, guided by AI circuit lines and a small team of silhouetted researchers.

Key takeaways

  • XBOW earned $250,000 from Google for a Chrome full exploit chain built with AI agents.
  • The agents ran OpenAI's publicly available GPT-5.6 Sol model.
  • The chain used bugs in V8 Maglev, animated WebP handling and Crashpad to escape Chrome's sandbox on Windows.
  • The awarded chain took six days and about $40,000 in compute, with four researchers directing the work.
  • All three bugs are fixed; Chrome users should update and relaunch.

Security firm XBOW said on 13 October 2026 that it earned a $250,000 reward from Google's Chrome bug bounty program for a full exploit chain built with AI agents running OpenAI's GPT-5.6 Sol, a publicly available model. XBOW says it is the first award under Google's 2026 rules.

What did the exploit chain do? #

The chain combined three previously unknown bugs in Chrome on Windows to get from loading a web page to running code outside the browser's sandbox. XBOW's technical write-up describes them as:

Part Component Bug
1 V8 Maglev compiler Reused a mutable boxed number during deoptimization
2 Animated WebP handling Combined cached geometry with changed image bytes
3 Crashpad crash handler Treated a failed read from a supposedly frozen renderer as a stable observation

Google's Chrome 152 release notes of 25 August 2026 credit XBOW's Brendan Dolan-Gavitt for CVE-2026-78952, a high-severity out-of-bounds write in Crashpad. XBOW says all three bugs are fixed.

How much did AI do? #

XBOW says four researchers, Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers, set the strategy, chose where to search, checked the AI's output and redirected the agents. The AI searched source code, tested ideas, built proofs of concept and drafted early exploit code.

The awarded chain was built between 2 and 7 August 2026 and cost about $40,000 in compute, XBOW says. A first attempt had to be reworked after Google said it already knew about one of the bugs, so the team built each part with an alternative that could be swapped in.

Why does this matter for defenders? #

XBOW argues that the cost and time of finding serious vulnerabilities are dropping for attackers and defenders alike. It expects each of the three bugs could be found by autonomous agents within a year, and says restricting access to public models is the wrong question. Its view is that defenders now have access to the same skills as attackers and should use them to test their own code first.

What should Chrome users do? #

  1. Make sure Chrome is up to date. The Crashpad fix shipped in Chrome 152 on 25 August 2026.
  2. Relaunch the browser when an update is waiting. XBOW notes that a downloaded fix only takes effect after Chrome restarts.

Sources

  1. XBOW: how we built a Chrome full-chain exploit, XBOW
  2. XBOW technical write-up of the three Chrome bugs, XBOW
  3. Chrome 152 stable update crediting XBOW, Google Chrome Releases

Questions this raises

Did the AI build the exploit on its own?
No. XBOW says four researchers set the strategy, checked results and redirected the agents, while the AI did much of the searching, testing and early exploit drafting.
Is Chrome still vulnerable?
XBOW says all three bugs are fixed. The Crashpad flaw, CVE-2026-78952, was fixed in Chrome 152 on 25 August 2026.
Which model was used?
OpenAI's GPT-5.6 Sol, which XBOW describes as publicly available.

AI SecurityArtificial IntelligenceVulnerabilitySecurity UpdateGoogleChromeBug BountyOpenAI