Security firm XBOW says it built a Chrome exploit chain capable of running native code outside the browser’s renderer sandbox in six days, earning a $250,000 reward from Google. The work combined human researchers with AI agents running OpenAI’s publicly available gpt-5.6-sol model, which OpenAI describes as designed for long-horizon vulnerability research and exploitation. XBOW said the chain could affect an estimated billion Chrome users on Windows, although the company’s demonstration was conducted against a specific Chrome build. [1]
The chain linked three previously undisclosed flaws: a V8 JavaScript-engine bug involving reuse of a mutable boxed number during deoptimization, an animated-WebP decoding issue that enabled a native out-of-bounds write, and a Crashpad memory-reading flaw that could overflow a handler-side object. Together, the bugs moved the attack from JavaScript execution inside a tab to code execution in Chrome’s unsandboxed crash handler. XBOW demonstrated the final stage by launching cmd /k calc.exe, rather than claiming that the test itself established broader compromise of a victim’s system. The technical report details the chain and its limitations. [2]
XBOW said its agents searched source code, tested hypotheses, developed proof-of-concept code and assembled exploit stages, while researchers selected targets, supplied context, redirected the searches and decided which components were suitable for the final chain. The campaign ran from Aug. 2 through Aug. 7, according to the company, and incurred roughly $40,000 in model and API costs. That timeline describes the final integration effort, not an unattended operation: XBOW said earlier research and substantial human expertise were necessary, and that a prior chain took about two months to submit.
Google’s public Chromium issue tracker identifies the fixes as changes 8255554 for the V8 issue, 8266257 and 8352899 for the animated-WebP issue, and 8267322 for the Crashpad flaw. The Crashpad fix limits a retry read to both the remaining bytes in a source page and the caller’s original requested length, preventing the retry from expanding the destination write. Chromium issue 547819997, issue 548509153 and issue 545820931 are the public technical references identified by XBOW. [2]
No CVE identifiers, affected-version ranges or fixed Chrome version numbers were listed in XBOW’s technical disclosure at publication time, so defenders should not infer a conventional CVE-based exposure window from the $250,000 award. The report also does not identify a public proof of concept or exploitation in the wild, and it names no threat actor. Google has confirmed the bugs, fixed them and paid the reward under Chrome’s revised vulnerability-reward rules, according to XBOW.
Administrators should therefore prioritize Chrome updates through their normal enterprise deployment channels and verify that managed Windows endpoints are running a current release, rather than waiting for CVE records to appear. The episode also illustrates why browser hardening remains layered: the exploit had to cross V8’s memory boundary, Chrome’s renderer sandbox and Crashpad’s separate process. OpenAI’s account of gpt-5.6-sol positions the model for cybersecurity work, but XBOW’s own description makes clear that the result depended on expert human guidance and build-specific exploit engineering. OpenAI’s model announcement provides the vendor’s description of its security capabilities. [14]
References
- XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days | XBOW
- Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain
- Previewing GPT-5.6 Sol: a next-generation model
