XBOW Used a Public OpenAI Model to Break Through Every Layer of Chrome in Six Days, and Google Paid $250,000

Breaking all the way through Chrome used to be a months-long job for an elite team. XBOW, an AI pentesting startup, did it in six days with agents running OpenAI's publicly available GPT-5.6 Sol model, and spent about $40,000 in compute doing it.

The result was a full-chain exploit built from three then-unknown Chrome bugs. Load a web page on Windows and the attacker's code runs. No click, no download. Google confirmed and fixed all three flaws and paid XBOW $250,000, its top reward for a full Chrome exploit.

Google hands out at most four of those a year. XBOW says this is the first full-chain reward under the 2026 rules, and the first ever paid to an autonomous security company.

Six days, after months of practice

The headline number deserves context. The challenge was set at a January staff meeting in Malta, and XBOW's first full Chrome chain took two months. The awarded chain came later, built between Sunday, August 2 and Friday, August 7, while the team of Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers was in Las Vegas for Black Hat and DEF CON.

"Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days," Dolan-Gavitt wrote in a technical writeup.

It nearly fell apart. One version relied on a bug Google already knew about. XBOW had built the exploit in swappable parts with backups, so the team replaced that piece and the chain held.

How the chain worked

Chrome wraps its JavaScript engine in two nested sandboxes: the V8 sandbox, sitting inside the operating system's process sandbox. XBOW's chain crossed both.

Stage one was a bug in Maglev, V8's mid-tier optimizing compiler, which reused a mutable boxed number during deoptimization. Tracked as CVE-2026-85045, it gave read and write access across V8's pointer-compression cage and was fixed in 152.0.7977.82 on September 3.

Stage two hit the animated WebP image decoder. It escaped the V8 sandbox by abusing a property the sandbox deliberately does not enforce, and that Blink wrongly assumed it could trust. No public identifier has been confirmed for it; Google fixed it during the Chrome 152 cycle.

Stage three was an overflow in Crashpad, Chrome's crash handler, which runs outside the sandbox. It turned one precise write into unsandboxed code execution. That one is CVE-2026-78952, fixed in 152.0.7977.65 on August 25. Both numbered bugs are rated high severity.

Humans still drove

The agents did a lot of the grinding. They searched Chrome's source code, tested hypotheses, built proofs of concept and wrote first drafts of exploit stages. People chose the targets, supplied context, pushed back on agent results and decided which pieces to join. "We did apply a fair bit of our own human expertise and judgment," Dolan-Gavitt wrote.

XBOW estimates about 1 billion people running Chrome on Windows were exposed before the fixes. The company says the bugs were never used against Chrome users. Unlike the V8 flaw Google patched after attackers got there first, this chain stayed in the bounty pipeline.

Chrome updates itself, but the fix only lands after the browser relaunches. Anyone who has left Chrome open for weeks should restart it and confirm the version reads 152.0.7977.82 or later.

The price of a break-in just dropped

Founder and CEO Oege de Moor framed it bluntly. "The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive," he said. He added that "a three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days."

The economics of bug hunting are shifting around that reality. Google this week quadrupled Chrome's base bounty for memory safety bugs to $2,000 after cutting payouts in April, still well below where rates stood before. It also recently closed its OSS VRP to product vulnerability submissions after a flood of AI-generated reports.

Government agencies have already warned about AI-built exploits probing industrial controllers. Dolan-Gavitt's own warning was shorter. "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!" he wrote, adding that the bar is now "significantly lower." His advice to defenders: "Defend accordingly."

Some offers on this page may be paid placements or contain affiliate links.