XBOW built a Windows Chrome exploit chain in six days with about $40,000 of AI compute
XBOW chained three unknown Chrome bugs into a Windows exploit that runs on page load, built in six days with a public OpenAI model, it said. Google fixed all three and paid its $250,000 top reward; the fixes apply only after Chrome restarts.
The Watch · Security desk
Key figures card. Dolan-Gavitt estimates a pre-LLM Chrome full chain took a team of four at least 6 months, around 6-9 months. XBOW's first full Chrome chain took 2 months. The awarded chain was built in 6 days.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Pre-LLM chain by team of four, at least, per Dolan-Gavitt | 6 months | range: around 6–9 months | 16 |
| XBOW's first full chain | 2 months | 13 | |
| Awarded chain build | 6 days | 11 |
What happened
- The chain started with memory control in Chrome's JavaScript engine, escaped its inner sandbox through the animated WebP reader, then used Crashpad, which runs outside the sandbox, to get code execution.
- The two bugs with public identifiers were fixed in Chrome 152.0.7977.65 on August 25 and in 152.0.7977.82 on September 3.
- XBOW says its agents searched source, tested ideas and drafted the exploit, while people picked targets, supplied context, challenged results and chose which pieces to join.
- Google's release notes credit XBOW's Brendan Dolan-Gavitt for two of the three bugs and list the fixing version for each.
Why it matters
- cost Stopping this chain costs a Chrome restart and a check that Chrome reports 152.0.7977.82 or later, since all three bugs are already fixed.
- exposure XBOW estimates 1 billion people running Chrome on Windows were at risk before the fixes, and a machine that updated but never restarted Chrome is still in that group.
- contradiction A scan for the WebP fix by CVE-2026-85045 would match the V8 bug instead, because Google and XBOW's write-up assign that number there and the WebP bug has no confirmed identifier.
The six-day figure sits on top of earlier work. The awarded chain came together from Sunday, August 2, to Friday, August 7, while the Black Hat and DEF CON conferences were running in Las Vegas [12]. XBOW had set itself the challenge back in January, at a staff meeting in Malta, and its first full Chrome chain took two months [13]. The $40,000 is the AI bill for the six-day run alone, by the company's count of its usage logs [14].
Brendan Dolan-Gavitt built the awarded chain with the agents [15]. "Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days," he wrote [16]. Taken at face value, six to nine months against six days is a factor of 30 to 45 in calendar time [24]. That sets a team estimate against a sprint with two months of prior work behind it, so we'd treat 30 to 45 as the top of the range.
One version of the chain almost fell apart when Google turned out to know already about one of the bugs it depended on [8]. Because XBOW had designed the exploit as interchangeable components with spares on hand, it swapped out the dead piece and the chain survived [8]. In our view a method that tolerates one dead bug is cheaper to run than one that has to start over.
"It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months," founder Oege de Moor said in the announcement [17]. Google's top reward is 6.25 times that compute bill [25]. It is a payout, not an attacker's market price, and the bill leaves out researcher time. Dolan-Gavitt wrote, "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!" [18] and closed with "Defend accordingly." [19]
Both identified bugs are rated high severity and need the user to load a page [20]. Google's confirmation covers the bugs, the fixes and the payment [2]. The claim that none of the three was used against Chrome users is XBOW's, and the material we have includes no independent confirmation of it [9].
This is one chain from one company. XBOW calls it the first full-chain Chrome reward under Google's 2026 rules and the first to an autonomous security company [21]. The program awards at most four a year [22].
What to watch
- A public identifier for the WebP bug, which would settle the CVE-2026-85045 mismatch between XBOW's announcement and Google's records.
- Any evidence from outside XBOW that one of the three bugs was exploited against Chrome users before the August 25 and September 3 fixes.
- A second full-chain Chrome reward built with AI agents, given that Google's program pays at most four a year.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+30
- Incentives70
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A team at XBOW chained three then-unknown Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.
- [2]
Google has confirmed all three bugs, fixed them, and paid XBOW its top $250,000 reward for a full Chrome exploit.
- [3]
Chrome updates on its own, but the fix only takes effect after the browser restarts; the action is to relaunch Chrome and confirm the version is 152.0.7977.82 or later.
- [4]
The first bug gave the attacker control of memory inside Chrome's JavaScript engine; the second, in the animated WebP image reader, used that control to break out of the engine's inner sandbox and make one precise write to memory; the third, in Crashpad, Chrome's crash handler that runs outside the sandbox, turned that write into full code execution.
- [5]
The two bugs that carry public identifiers were fixed in Chrome 152.0.7977.65 on August 25 and 152.0.7977.82 on September 3.
- [6]
XBOW's AI agents searched Chrome's source code, tested ideas, built proofs of concept and wrote first drafts of the exploit; the researchers chose targets, supplied context, challenged the agents' results and decided which pieces to join.
- [7]
Google's own release notes credit Dolan-Gavitt of XBOW for two of the three bugs and list the version that fixed each.
- [8]
One version of the awarded chain nearly failed when a bug it relied on turned out to be one Google already knew about; XBOW had built the exploit in swappable parts with backups ready, so it replaced that part and the chain held.
- [9]
XBOW says the three bugs were never used against Chrome users.
- [10]
The WebP bug was fixed in the same Chrome 152 cycle, but no public identifier can be confirmed for it: CVE-2026-85045, the identifier XBOW's announcement gives the WebP stage, is the identifier Google and XBOW's own technical write-up both assign to the V8 bug.
- [11]
XBOW researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model.
- [12]
XBOW built the awarded chain between Sunday, August 2, and Friday, August 7, during the Black Hat and DEF CON conferences in Las Vegas.
- [13]
The sprint followed months of earlier work: XBOW set the challenge at a January staff meeting in Malta, and its first full Chrome chain took two months to complete.
- [14]
By the company's own count of its usage logs, the six-day run cost about $40,000 in AI charges.
- [15]
One researcher, Brendan Dolan-Gavitt, built the awarded chain with the agents.
- [16]
Dolan-Gavitt wrote: "Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days."
- [17]
Founder Oege de Moor said in the announcement: "It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months."
- [18]
Dolan-Gavitt wrote: "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!"
- [19]
Dolan-Gavitt wrote that the bar is now much lower: "Defend accordingly."
- [20]
Both identified bugs are rated high severity and need the user to load a page.
- [21]
XBOW calls this the first full-chain Chrome reward under the 2026 rules and the first to an autonomous security company.
- [22]
Google's Chrome Vulnerability Reward Program pays up to $250,000 for a full-chain exploit, the most it offers for a single report, under rules it updated in 2026, and awards at most four of these a year.
- [23]
Before the fixes shipped, the bugs put an estimated 1 billion people running Chrome on Windows at risk of this kind of attack, according to XBOW.
- [24]
Dolan-Gavitt's 6-9 month estimate against six days is a 30 to 45 times difference in calendar time.
- [25]
Google's $250,000 top reward is 6.25 times the roughly $40,000 AI compute bill for the six-day run.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- cryptobriefing.comXBOW uses OpenAI’s GPT-5.6 to exploit Chrome, earns $250,000 bounty
1 article · October 13, 2026
- thehackernews.comResearchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.