XBOW says its security researchers earned a $250,000 reward from Google after building a full-chain Chrome exploit with AI agents.
The team says the work took six days and about $40,000 in computing costs, using OpenAI’s publicly available GPT-5.6 Sol model. Google has fixed the flaws.
XBOW disclosed the work on October 13, 2026. Its chain linked three bugs to move from JavaScript in a Chrome tab to code execution outside the browser’s renderer sandbox. The company estimated that the issue could affect about one billion users worldwide, while the demonstration targeted Windows.
Google Awards $250K for Chrome Exploit
A sandbox limits what a compromised web page can do. A full chain joins bugs to cross Chrome’s defenses in sequence. XBOW demonstrated a crafted page launching a program on a test system. It did not report the exploit being used against people.
The first flaw was in V8, Chrome’s JavaScript engine. XBOW says a bug in the Maglev compiler let separate JavaScript objects share a changeable number during deoptimization, when V8 moves from optimized code to a less optimized path. Changing the value could mislead optimized code and give the exploit memory access inside V8’s protected region.
The second flaw affected animated WebP images. The decoder could use frame details saved from one image while reading changed image data. That mismatch caused an out-of-bounds write and allowed the chain to leave the V8 sandbox.
The third flaw was in Crashpad, Chrome’s crash-reporting system. On Windows, Crashpad could retry a failed memory read using a length based on the rest of a page. The code assumed the renderer would not change.
XBOW’s exploit changed page access during the retry, causing an oversized read and memory corruption in the handler outside the renderer sandbox.
XBOW says its researchers guided the work. They chose targets, split tasks, checked AI results, and prepared backups. The team replaced an early chain after Google said one part was already known. A modular design let it swap in another bug. The company said it developed the final chain from August 2 to August 7.
Google’s Chrome Vulnerability Reward Program offers $250,000 for an eligible full-chain exploit that works from web content on an active Chrome release. The rules require a working demonstration and responsible testing. The award recognizes a reported flaw, not a confirmed compromise of users’ devices.
Users should keep Chrome up to date and relaunch it when an update is ready. XBOW says Google fixed all three flaws. Cybersecurity News has covered an XBOW AI agent finding a Linux kernel flaw and a Chrome update fixing multiple vulnerabilities. Here you can find more details on Google’s reward rules.
AI may shorten the time needed to find complex flaws. Software teams should use these tools to test their own products, with human review and coordinated fixes central to security work.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
