Artificial Intelligence
XBOW chained Chrome bugs into a full exploit
XBOW said it combined three Chrome vulnerabilities into a Windows code-execution chain in six days using AI agents built on OpenAI’s public GPT-5.6 Sol model, and Google paid the company $250,000.
- XBOW said it chained three previously unknown Chrome bugs into one attack that ran code on a Windows computer after a page loaded.
- The company said AI agents using OpenAI's public GPT-5.6 Sol model built the chain in six days.
- Google confirmed the bugs, fixed them in Chrome, and paid XBOW $250,000 for the full exploit.
- Google's release notes fixed two identified bugs in Chrome 152.0.7977.65 on 25 August and 152.0.7977.82 on 3 September.
- XBOW said the awarded chain was built between 2 August and 7 August and cost about $40,000 in AI charges.
XBOW said it chained three Chrome vulnerabilities into one exploit that ran code on a Windows machine when a user loaded a web page. Google later confirmed the bugs, fixed them, and paid XBOW the programme's top reward of $250,000.
XBOW said AI agents running OpenAI's public GPT-5.6 Sol model built the chain in six days. The company said that work took place between 2 August and 7 August, and that its usage logs put the AI cost at about $40,000.
The chain touched three parts of Chrome: the JavaScript engine, the WebP image handling code and Crashpad. XBOW said one bug gave control of memory inside the engine, one turned that into a write outside the inner sandbox, and one used that write to reach code execution.
Google's release notes credited Brendan Dolan-Gavitt of XBOW for two of the bugs and gave the versions that fixed them. XBOW said the bugs had not been used against Chrome users, and said Chrome updates take effect after a restart.
Named in this story
People
- Brendan Dolan-Gavitt
- the XBOW researcher who built the awarded chain with the agents
- Oege de Moor
- the XBOW founder who said the speed was the point
Companies
- XBOW
- the security firm that said it built the Chrome exploit chain
- the company that confirmed and fixed the bugs and paid the reward
- OpenAI
- the company whose public GPT-5.6 Sol model was used by the agents
Organisations
- Google Chrome Vulnerability Reward Program
- the programme that paid up to $250,000 for the full-chain report
Products and systems
- Chrome
- the browser whose bugs were chained into the exploit
- Windows
- the operating system on which code execution was achieved
- V8
- the Chrome JavaScript engine where one of the bugs sat
- Crashpad
- the Chrome crash handler used in the final stage of the chain
- WebP
- the image format code that one bug affected
How the source tells it
The register was mostly factual, but it leaned towards triumph and urgency through XBOW's award framing, speed claims and defender warning.
- triumph the award, first-of-its-kind claims and speed comparison framed the work as a notable win
- urgency the warning that defenders should relaunch Chrome and the call to defend accordingly pushed immediate action
- vendor boosterism the company's own account of its achievement and its cost was repeated as the story's main organising frame