Google has awarded XBOW $250,000 for creating an AI-assisted exploit chain that enabled code execution outside the Chrome browser’s renderer sandbox on Windows.
This reward marks the first full-chain payout for Chrome under Google’s vulnerability reward program, introduced in April 2026. According to XBOW, all three vulnerabilities involved have since been fixed.
Google Pays $250,000 for AI
The researchers developed the awarded exploit between August 2 and August 7, after earlier research and unsuccessful submissions. XBOW estimated around $40,000 in API charges for this six-day campaign.
Researchers Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers collaborated with AI agents, combining human expertise with automated vulnerability discovery and exploit development.
To support their work, XBOW used OpenAI’s publicly available GPT-5.6 Sol model, along with its predecessors, to search source code, test hypotheses, create proofs of concept, and develop various stages of the exploit.
The researchers selected targets, reviewed findings, redirected investigations, and integrated components. Their demonstration successfully launched Windows Calculator from a webpage using signed Chrome Beta, proving execution beyond the renderer’s containment boundary.
The first vulnerability involved Maglev, which is V8’s mid-tier optimizing compiler. During the deoptimization process, which reconstructs JavaScript objects when optimized assumptions fail, Maglev incorrectly reused a mutable HeapNumber as if it were immutable.
This error caused separate objects to share the same boxed numeric value, allowing changes that undermined the compiler’s bounds reasoning. The exploit exploited this inconsistency to gain read and write access throughout V8’s four-gigabyte pointer-compression cage.
The second stage targeted animated WebP decoding via WebCodecs ImageDecoder. After compromising memory within the V8 cage, attackers could maintain write access to image bytes that Blink considered to be exclusively owned.
Modifying these bytes after the frame geometry was cached created a time-of-check/time-of-use mismatch, leading the decoder to combine the geometry of one image with the payload of another. This overflowed a native bitmap allocation, enabling a targeted write to native memory.
This write ultimately redirected WebAssembly execution through an existing instruction sequence, allowing the delivery of native code inside the renderer.
The final vulnerability targeted Crashpad, Chrome’s crash-reporting handler, which operates outside the renderer sandbox. A Windows thread could bypass process freezing and alter memory protections while Crashpad assumed the renderer was suspended.
A failed memory read triggered an oversized retry, overflowing a destination buffer and corrupting an adjacent Crashpad object.
The researchers redirected legitimate handler functionality to launch Windows Calculator while adhering to the tested control flow and shadow stack protections. This enabled unsandboxed execution of Windows code, going beyond control over webpage content.
The fixes prevent reusing mutable HeapNumbers, ensure WebP output buffers stay within actual bitmap boundaries, and cap Crashpad retries at the original requested length.
XBOW’s modular design also allowed researchers to replace duplicate vulnerabilities without rebuilding the entire exploit chain. Users are encouraged to update and relaunch Chrome to apply the installed fixes.
This research highlights the acceleration of exploit development; however, the successful six-day result relied on substantial prior work, expert oversight, and reusable techniques developed by XBOW’s human researchers.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
