Skip to content
Brief Security & Trust ·

XBOW says AI helped build a Chrome exploit chain in six days, after months of groundwork

Google fixed all three bugs and paid the security firm its top $250,000 reward; XBOW says none were used against users.

In brief
  • XBOW built a research exploit chain for Chrome on Windows and reported it to Google. It was not an attack on users.
  • The six days came after months of work, and people still chose targets and joined the pieces.

The Hacker News reported on 14 October that security firm XBOW built a research exploit chain for Chrome on Windows. Its team directed AI agents running OpenAI's public GPT-5.6 Sol model. Three bugs, then unknown, were joined so that loading a web page ran code on the computer. XBOW says the build took six days in early August, after months of groundwork. Google fixed the bugs and paid XBOW $250,000, its top reward for a full chain. XBOW says no Chrome users were attacked with them.

Chrome runs page code inside two nested sandboxes, which are walls that keep a bad page away from the computer. A chain needs a bug to get past each layer. XBOW's three sat in different parts of Chrome, including V8 and the WebP image format. Two bugs have public identifiers. Chrome 152.0.7977.65 fixed one on August 25, and 152.0.7977.82 fixed the other on September 3. The Hacker News could not confirm an identifier for the WebP bug. XBOW says agents searched code and drafted exploits, while people chose targets and decided what to join. It puts the AI cost at about $40,000.

For budget holders, XBOW's account suggests the scarce skill is directing the AI, not doing the searching. Ask how quickly your organisation can confirm that every browser has restarted on version 152.0.7977.82 or later, since the fix only applies after a restart.

A WebPulse Brief: a short report of an important event, written by the WebPulse Newsroom with AI assistance and checked against the reporting below. When there is more to explain, we follow up with a full story. How we use AI.

Reporting: Google Chrome Releases (Chrome security team).