XBOW collected Google's top $250,000 Chrome bug bounty after its AI agents chained three unknown flaws into a working exploit in six days.[1][2] The attack ran code outside the browser's sandbox on Windows when a victim did nothing more than load a page, the Seattle security company said in its 13 October disclosure.[1][3] Google reproduced the chain, confirmed it, and shipped fixes for all three bugs.[1]

Before those patches, the flaw sat in the path of an estimated one billion people running Chrome on Windows worldwide.[1] An attacker who reached that far could install malware, ransomware or spyware, move laterally across a network, or read credentials and files.[1]

Three bugs, two sandboxes

Chrome contains an attacker in layers.[2] A memory corruption bug in the JavaScript engine gives control inside V8's in-process sandbox, where object references are stored as offsets inside a reserved 4 GiB region.[2] A second boundary, the operating system process sandbox, holds the renderer itself, and crossing both usually takes months of work by a team.[2][3]

The XBOW chain crossed both in three stages:

• A bug in Maglev, V8's mid-tier optimizing compiler, reused a mutable boxed number during deoptimization, which gave the exploit read and write access throughout V8's pointer-compression cage.[2]
• A bug in Chrome's animated WebP decoder, tracked as CVE-2026-85045, combined cached geometry with changed image bytes to produce one precise native write outside that cage.[1][2]
• A bug in Crashpad, Chrome's crash handler, tracked as CVE-2026-78952, turned that write into full code execution in the unsandboxed handler.[1][2]

Google's fix for the V8 bug removed the literal-object special case in the Maglev deoptimizer, so virtual HeapNumbers now follow the ordinary captured-object path and each deoptimization creates a fresh box instead of reusing one.[2] XBOW published root-cause reports for all three issues, and the company says none of the flaws was ever used against Chrome users.[1]

Six days, $40,000, one researcher

XBOW researcher Brendan Dolan-Gavitt built the awarded chain with agents running OpenAI's gpt-5.6-sol, the same model any paying customer can rent, rather than a specialized or access-restricted security system.[3][5] The team split the work into parallel campaigns with narrower goals: broad vulnerability search, V8 memory corruption, a V8 sandbox escape, a renderer sandbox escape, and integration.[2]

Humans set the targets, supplied context, challenged results and decided which parts to join, while agents searched source code, tested hypotheses, built proofs of concept and drafted exploit stages.[2][3] XBOW reconstructed the campaign's cost from archived Codex logs and put it at roughly $40,000 in API charges.[2] The winning chain was built between Sunday 2 August and Friday 7 August, during Black Hat and DEF CON in Las Vegas.[2][3][6]

"Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days."
Brendan Dolan-Gavitt, XBOW[2]

That timeline is the number XBOW wants defenders to sit with, because the model doing the heavy lifting was one any paying customer can rent.[3][5]

The chain that died first

The awarded exploit was a second attempt on a target XBOW had already broken once.[2] Google told the team that its first full chain relied on a bug the browser maker already knew about internally, which disqualified the submission.[3][4] XBOW had built the exploit as three independent components, each with a backup route, so it replaced the colliding part and kept the rest of the chain intact.[2][3]

Google's Chrome Vulnerability Reward Program pays up to $250,000 for a full-chain exploit and awards at most four of them a year.[4][6] XBOW says this was the first full-chain award under the programme's 2026 rules and the first granted to an autonomous offensive security company.[1][4] The company is waiting on Google to review two more exploits built with the same publicly available model.[5]

What defenders should take from it

XBOW's argument is about cost rather than novelty.[3] Human teams have chained Chrome bugs before, but they needed more people and more time than one researcher spending $40,000 in tokens.[2][3]

"It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months. Attackers are working with this speed and ease, and defenders need a similar pace to find the exploitable paths among their many findings," said Oege de Moor, founder and CEO of XBOW.[1]

De Moor told Forbes that defenders and attackers now work with largely the same technology, and that patching speed is the variable that matters.[5] "Bad guys can do this kind of thing much easier than they used to," he said.[5] OpenAI's head of cyber research, Clint Gibler, framed the result as a defensive win: "A single XBOW researcher used our models to uncover a chain of vulnerabilities that Google has now fixed."[1]

The result lands in a year of AI-assisted attacks: in September, Forbes reported that a hacker used a mix of models including DeepSeek and Anthropic's Claude to attack more than 100 companies and steal over 600,000 credit card details.[5] XBOW expects agents working alone to find each of the three Chrome bugs within a year.[3]

Its advice for ordinary users is specific: Chrome installs updates on its own, but a fix only takes effect once the browser is relaunched, so restart it when the update prompt appears.[3] For teams, XBOW argues the falling cost of finding bugs cuts both ways, and that testing your own software first is an advantage attackers do not have.[3]

Sources

1. XBOW, "XBOW Rewarded for Exploit Affecting a Billion Users," 13 October 2026
2. B. Dolan-Gavitt, "Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain," XBOW Labs, 13 October 2026
3. XBOW, "XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days," 13 October 2026
4. The Hacker News, "Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days," 14 October 2026
5. T. Brewster, "An OpenAI Model Found Three Previously Unknown Security Flaws In Google Chrome," Forbes, 13 October 2026
6. The Register, "Security researchers spent 6 days doing their Chromework, built 1B user exploit," 14 October 2026