XBOW used a public OpenAI model to build a $250,000 Chrome full-chain exploit in six days

Security firm XBOW used AI agents running a publicly available OpenAI model to build a full-chain Google Chrome exploit in six days, earning Google's top $250,000 bug bounty, The Hacker News reported on October 14, 2026. The chain combined three previously unknown bugs so that simply loading a web page could run code on a Windows computer, escaping both of Chrome's nested sandboxes. Google has fixed all three bugs, and XBOW says they were never used against Chrome users.

What happened

According to the report, XBOW's team directed agents running OpenAI's GPT-5.6 Sol model to search Chrome's source code, test ideas, build proofs of concept and draft the exploit. Human researchers chose targets, supplied context, challenged the agents' findings and decided how to combine the pieces. Researcher Brendan Dolan-Gavitt worked on the awarded chain.

The chain was built between August 2 and August 7, 2026, during the Black Hat and DEF CON conferences, following months of earlier work; XBOW's first full Chrome chain reportedly took two months. The company says the six-day run cost about $40,000 in AI charges, based on its own usage logs. At one point a bug the chain relied on turned out to be already known to Google, but because the exploit was built from swappable components, the team replaced it.

Technical details

The Hacker News describes three stages. The first, a V8 JavaScript engine bug tracked as CVE-2026-85045, gave control of memory in the engine and was fixed in 152.0.7977.82 on September 3. The second, in the animated WebP image decoder, was used to escape the inner sandbox with a single precise memory write; the publication says no public identifier for this bug could be confirmed. The third, a Crashpad crash-handler bug tracked as CVE-2026-78952 and fixed in 152.0.7977.65 on August 25, turned that write into full code execution outside the sandbox. Both identified bugs are rated high severity.

Google paid $250,000, the maximum full-chain reward under its 2026 Chrome Vulnerability Reward Program rules, which award at most four such prizes a year. XBOW calls it the first full-chain Chrome reward under the new rules and the first paid to an autonomous security company.

Why it matters

XBOW estimates that about one billion Chrome users on Windows were exposed to this class of attack before the fixes shipped. Dolan-Gavitt said a Chrome full chain previously required a four-person team roughly six to nine months of work. He warned defenders that six days and $40,000 is a small investment for such an exploit and urged them to defend accordingly. The case adds to growing evidence that AI models are sharply lowering the time and cost of developing advanced browser exploits.

What to do

Chrome users on all platforms should confirm they are running version 152.0.7977.82 or later; current releases already include these fixes. Chrome must be relaunched for updates to take effect. Organizations should enforce automatic browser updates and relaunch deadlines through management policies, and should shorten patch windows for browsers given the falling cost of exploit development.