“Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days,” XBOW researcher Brendan Dolan-Gavitt wrote in a technical write-up.
Security company XBOW has won $250,000 from Google’s Chrome bug bounty programme, XBOW said on 13 October. It built the exploit with AI agents running OpenAI’s GPT-5.6 Sol. The attack chained three unknown Chrome bugs. Loading a web page was enough to run code outside Chrome’s sandbox on a Windows computer, with no click or download.
XBOW says it is the first full-chain Chrome award under rules Google introduced in April 2026. Google has fixed all three bugs, and XBOW says they were never used against Chrome users. Before the fixes, the bugs exposed about one billion people running Chrome on Windows, by the company’s estimate.
Six days and $40,000
Dolan-Gavitt and the agents built the awarded chain between 2 and 7 August, while the team was in Las Vegas for Black Hat and DEF CON. XBOW puts the compute cost at about $40,000, based on its usage logs. Founder and CEO Oege de Moor wrote that the company chose a model available to anyone on purpose.
The six days followed months of work. De Moor set the challenge at a company meeting in Malta at the start of 2026. Four researchers took it on: Dolan-Gavitt, Andrés Luksenberg, Baul Lee and Willem Pinckaers. Their first chain failed when Google said it already knew one of the bugs, so the team swapped in a backup stage.
The agents searched Chrome’s source code, tested ideas, built proofs of concept and wrote the first drafts of each stage. The researchers chose the targets, supplied context, challenged the results and decided which parts to join.
“We did apply a fair bit of our own human expertise and judgment,” Dolan-Gavitt wrote.
Three bugs, two sandboxes
Chrome keeps JavaScript inside a sandbox in its V8 engine, and keeps each page inside a second sandbox run by the operating system. The chain crossed both. A bug in V8’s Maglev compiler gave the attacker read and write access inside the V8 sandbox. A bug in the decoder for animated WebP images then made one chosen write outside it.
The third bug sat in Crashpad, Chrome’s crash handler, which runs outside the sandbox. It turned that single write into full code execution. Google’s release notes for Chrome 152 credit Dolan-Gavitt of XBOW for the Crashpad flaw, CVE-2026-78952, rated high.
The fixes shipped in Chrome updates on 25 August and 3 September, The Hacker News reported. Chrome installs updates on its own, but a fix only takes effect after the browser restarts. In September, Google also patched a separate V8 flaw that attackers were already using.
A public model
OpenAI released GPT-5.6 to everyone in July. In August, it paused a model over cyber risk. De Moor argues that restricting powerful models is the wrong question, because the model XBOW used is already public. He expects agents working alone could find each of the three bugs within a year.
“We want to help more defenders find and fix critical vulnerabilities faster,” Clint Gibler, head of cyber research at OpenAI, said in XBOW’s press release.
Dolan-Gavitt ended his write-up with a warning to defenders.
“Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!” he wrote. “Defend accordingly.”