XBOW researchers used AI to hack Google Chrome in six days, from August 2 to August 7, 2026, linking three vulnerabilities to run code on Windows outside the browser’s sandbox. The research, published on October 13, 2026, earned a $250,000 reward from Google. By then, Google had patched the flaws.
Key takeaways
- XBOW’s demonstration linked flaws in three Chrome components.
- The team spent about $40,000 on AI-model API calls.
- Chrome 153 and later versions protect against the disclosed vulnerabilities.
According to ilSoftware.it, the demonstration ended with Windows Calculator opening—a visible proof that the exploit had reached beyond Chrome’s protections. Paid out via the Chrome Vulnerability Reward Program, this marked the first time such an amount was granted for a full compromise chain since the rules took effect in April 2026.
How XBOW used AI to hack Google Chrome in six days
XBOW used agents based on OpenAI’s gpt-5.6-sol model to examine source code, find potential vulnerabilities, test hypotheses and develop individual exploit components. Human researchers chose the targets, interpreted the results and decided how to connect the techniques.
The agents tackled limited problems involving the JavaScript engine, memory isolation and escape from the process that runs web pages. The team spent about $40,000 on API calls during the research.
XBOW estimated that, without advanced language models, four specialists would have needed six to nine months to build an exploit chain of comparable complexity.
The report describes the acceleration as the ability to investigate technical hypotheses in parallel, test alternatives and quickly discard unsuccessful approaches. AI assisted the work; human researchers assembled the connected attack.
Three Chrome components formed the exploit chain
The exploit connected vulnerabilities in Chrome’s JavaScript engine, its WebP animated-image decoder and Crashpad, the component that collects crash information. Each stage overcame a different protection before the demonstration reached Windows.
JavaScript and WebP flaws opened access to memory
The first flaw affected Maglev, an optimizing compiler in the V8 JavaScript engine. Incorrect handling of certain numeric objects let the researchers bypass array bounds checks and read or modify memory within the V8 sandbox.
A separate flaw in the WebP decoder allowed an image-dimension mismatch that caused a heap buffer overflow. The resulting access to native memory enabled manipulation of references to WebAssembly code and instruction execution in the renderer process, which remained inside Chrome’s sandbox.
Crashpad provided the final escape
The final stage exploited Crashpad’s assumption that a process was suspended. XBOW kept a thread running and changed memory-page permissions during reads, producing another out-of-bounds write—this time in the Crashpad process, outside the sandbox.
By manipulating the component’s internal structures and using functions already present in Chrome, the researchers invoked the Windows API CreateProcessW() to open Windows Calculator. That demonstrated code execution outside the browser sandbox.
A shared weakness behind three different flaws
All three vulnerabilities relied on assumptions about conditions that could change. The JavaScript compiler treated a mutable numeric object as immutable; the WebP decoder assumed data transferred from JavaScript would stay unchanged.
Crashpad similarly assumed that a suspended process could not alter its memory pages. The report identifies the common problem as trusting a condition without ensuring it remains valid—not simply an absence of checks.
The demonstration required a connected chain of errors, rather than one isolated vulnerability. Using AI to hack Google Chrome accelerated the development of that chain to six days.
Google’s patches and Chrome 153 protection
Google distributed fixes for the exploited vulnerabilities between August and September 2026. Users running Chrome 153 or newer are protected against exploitation of these specific flaws.
The research publication on October 13, 2026, followed those patch releases and reported the $250,000 reward for the complete compromise chain.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.