Six Days and $40,000 of AI Compute: XBOW Chains Three Chrome Zero-Days Into a Full Exploit That Won the Top $250,000 Bounty

A security research team at XBOW built a complete exploit chain against Google Chrome in six days, using autonomous AI agents running on OpenAI's publicly available GPT-5.6 Sol model - and Google paid the firm its highest reward for it. In a disclosure published on October 13, the AI-driven offensive security company said researcher Brendan Dolan-Gavitt directed agents that chained three previously unknown Chrome vulnerabilities into a single attack which executes code on a Windows machine when the user merely loads a web page, with no clicks or downloads required.

The chain crossed both of Chrome's nested sandboxes in three stages. The first bug, in the Maglev optimizing compiler of the V8 JavaScript engine (CVE-2026-85045), came from a reused mutable boxed number during deoptimization and gave the attacker read and write access across V8's pointer-compression cage. The second, in the animated-WebP image decoder, escaped the V8 sandbox by exploiting a property the sandbox deliberately does not enforce and that Blink incorrectly assumed it could trust; the disclosure notes this stage has no public CVE identifier, and that the identifier XBOW's announcement assigns it is in fact the V8 bug's. The third, a memory-safety overflow in Crashpad - the crash handler that runs outside the sandbox (CVE-2026-78952) - turned the single write into full code execution on the host.

The division of labor was explicit. The AI agents searched Chrome's source code, tested the team's hypotheses, developed proofs of concept and drafted exploit stages. The human researchers chose targets, supplied context, challenged the agents' results and decided which attack components to chain. That modular design mattered: when one bug in a candidate chain turned out to be one Google already knew about, the team swapped in a backup component and the chain survived.

The economics are the story XBOW wants defenders to read. Before LLMs, the company said, a Chrome full chain took a team of four roughly six to nine months; its own first submission this year took two months; the awarded one took six days and, by its own usage logs, about $40,000 in AI compute. Google confirmed and patched all three bugs and paid the $250,000 maximum - the Chrome Vulnerability Reward Program's top full-chain payout, capped at four per year, and by XBOW's account the first full-chain reward under the 2026 rules and the first ever to an autonomous security company. For scale, exploit broker Crowdfense advertises up to $1.5 million for desktop Chrome zero-day chains, six times the official bounty. XBOW estimates the unpatched bugs put roughly one billion Chrome on Windows users at risk and says there is no evidence they were ever used in real attacks.

The fixes shipped in Chrome 152.0.7977.65 on August 25 and 152.0.7977.82 on September 3, both rated high severity. Because Chrome installs updates automatically but only applies them on relaunch, users are advised to restart the browser and confirm they are on 152.0.7977.82 or later.

Greg Brockman, OpenAI's president, amplified the result on X, noting that a public model and $40,000 of compute produced what used to take months. Dolan-Gavitt's warning to defenders was blunter: "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain. The bar is significantly lower" for attackers armed with LLMs, he wrote. "Defend accordingly."