Security Researchers Build Chrome Exploit in 6 Days Using AI, Earn $250,000 Google Bounty

AI-Powered Chrome Exploit Development Stuns Security Community

Security researchers at Xbow demonstrated how AI in cybersecurity is fundamentally changing the threat landscape by building a full-chain exploit for Google Chrome in just six days. The team used OpenAI's GPT-5.6 Sol model to chain three zero-day vulnerabilities that could execute code outside the browser sandbox on Windows machines, potentially affecting approximately 1 billion users worldwide1

1

. Google confirmed all three bugs, patched them, and awarded Xbow its top $250,000 reward for a Chrome exploit under its updated 2026 Chrome Vulnerability Reward Program rules2

2

.

The research team—Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers—completed the work during the Black Hat and DEF CON conferences in Las Vegas, spending approximately $40,000 in token charges1

1

. Xbow CEO Oege de Moor emphasized the speed factor: "A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days"1

1

.

How AI Agents Accelerated Exploit Development

The GPT-5.6 Sol model served as the engine for accelerating exploit development, though security researchers maintained crucial oversight throughout the process. AI agents searched Google Chrome's source code, tested hypotheses, developed proofs of concept, and wrote initial exploit stages1

1

. Meanwhile, the human researchers selected targets, provided context, challenged the agents' findings, and determined which attack components to chain together. Dolan-Gavitt acknowledged: "We did apply a fair bit of our own human expertise and judgment"1

1

.

The six-day sprint between August 2 and August 7 followed months of preparation. Xbow set the challenge at a January staff meeting in Malta, and their first full Chrome chain took two months to complete2

2

. The awarded chain nearly failed when one bug turned out to be already known to Google, but the team's modular approach allowed them to swap components and maintain the attack chain2

2

.

Breaking Through Chrome's Nested Security Barriers

The full-chain exploit crossed two critical security boundaries in three vulnerability stages, demonstrating sophisticated understanding of Chrome's architecture1

1

. The first vulnerability exploited a V8 compiler bug in Maglev, Chrome's mid-tier optimizing compiler, involving a reused, mutable boxed number during deoptimization that granted attackers read and write access throughout V8's pointer-compression cage1

1

.

The second stage targeted an animated WebP decoder bug that served as a V8 sandbox escape. Rather than attacking the sandbox directly, the exploit leveraged a property the V8 sandbox deliberately doesn't enforce but that Blink incorrectly assumed it could trust1

1

. The final stage exploited an overflow in Crashpad, Chrome's crash handler that runs outside the sandbox, to cross the outer process boundary and achieve unsandboxed code execution on the host1

1

.

Implications for Defenders and the Lowered Barrier for Attackers

The research demonstrates that large language models have dramatically reduced the resources required for sophisticated attacks. Dolan-Gavitt noted that pre-LLMs, a Chrome full chain would take a team of four around 6-9 months to produce2

2

. The time and $40,000 spent illustrate that "the bar is significantly lower" for attackers armed with AI capabilities1

1

.

Google fixed the vulnerabilities in Chrome versions 152.0.7977.65 on August 25 and 152.0.7977.82 on September 32

2

. Both identified bugs carry high severity ratings and required only that users load a malicious page. While Chrome updates automatically, fixes only take effect after browser restart, making it critical for users to relaunch Chrome and verify they're running version 152.0.7977.82 or later1

1

.

This marks the first full-chain Chrome reward under Google's 2026 bounty program rules and the first awarded to an autonomous security company2

2

. Dolan-Gavitt's warning to defenders captures the urgency: "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain! Defend accordingly"2

2

.