XBOW said on October 13, 2026, that Google paid it $250,000 for a Chrome full-chain exploit that combined three previously unknown chrome vulnerabilities. Loading a malicious web page could have given an attacker code execution outside Chrome’s security sandbox without requiring a click or download, although Google reproduced the chain, fixed the vulnerabilities and XBOW said it was never used against Chrome users.
Key Points
- XBOW developed the Chrome attack chain in six days with help from AI agents.
- The chain could have affected about one billion people running Chrome on Windows, according to XBOW’s estimate.
- Google fixed the vulnerabilities through Chrome updates after reproducing the exploit.
- The $250,000 payment was Google’s first Chrome full-chain award under its 2026 rules and the first such award to an autonomous offensive-security platform.
Timeline
Exploit Chain Developed XBOW built the Chrome exploit chain in six days using AI agents.
Vulnerability Reported XBOW researcher Brendan Dolan-Gavitt reported the Crashpad flaw.
Security Fix Released Chrome 152.0.7977.65 fixed CVE-2026-78952.
$250,000 Award Announced XBOW announced Google’s bounty payment for the full exploit chain.
How the chain was built
XBOW said the awarded chain was developed from Sunday, August 2, through Friday, August 7, 2026, while its team was in Las Vegas for the Black Hat and DEF CON conferences. The effort followed a challenge issued at an XBOW all-hands meeting in Malta at the start of 2026 to build a full-chain Chrome exploit before the annual Black Hat conference.
XBOW’s blog named Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers as the four researchers who took on the broader challenge. Its technical account said Dolan-Gavitt and AI agents built the awarded chain during the August sprint.
An earlier chain took two months and had to be replaced after Google told XBOW that one of its bugs was already known. XBOW said the first chain’s V8 sandbox-escape stage used a Gin vulnerability that duplicated an existing issue, so the team replaced it with the animated-WebP stage used in the awarded chain.
The exploit was designed in modular stages with alternative components, allowing the researchers to replace one vulnerability without rebuilding the rest of the chain. XBOW divided the work among parallel campaigns focused on broad vulnerability searches, V8 memory corruption, a V8 sandbox escape, a renderer sandbox escape and final integration.
XBOW said it used OpenAI’s publicly available GPT-5.6 Sol model rather than a specialized security model or a model with restricted access. The AI agents searched Chrome’s source code, tested hypotheses, built proofs of concept and developed exploit stages, while the researchers selected targets, supplied context, reviewed results, redirected searches and chose which components to combine.
How the attack worked
XBOW said the chain crossed Chrome’s two main containment boundaries, the V8 JavaScript-engine sandbox and the operating-system sandbox around the renderer. The first stage involved a Maglev compiler bug that gave the attacker memory control inside V8’s sandbox.
According to XBOW’s technical account, a vulnerable Maglev deoptimization path could cause separate JavaScript objects to share a mutable HeapNumber representing a double field. The exploit used that discrepancy to influence an optimized memory access and obtain access across V8’s 4 GiB sandbox region. XBOW did not assign a CVE number to this stage in its account.
The second stage used an animated WebP decoder vulnerability tracked as CVE-2026-85045. XBOW said the bug broke out of the V8 sandbox and produced a precise native-memory write.
The technical account describes a transferred image buffer whose bytes could still be changed through a surviving JavaScript view. The decoder used cached frame geometry from one animated WebP while reading changed image data from another, allowing decoded output to exceed the allocated buffer.
The final stage involved CVE-2026-78952 in Crashpad, Chrome’s crash-reporting handler, which runs beside Chrome and accepts data across the sandbox boundary. XBOW said the issue turned the native-memory write into code execution outside the renderer sandbox.
XBOW described CVE-2026-78952 as a Windows remote-memory-read retry bug. A renderer thread that continued running during process suspension could change page permissions between a failed read and its retry, allowing the retry to read beyond the caller’s requested buffer and corrupt an adjacent Crashpad allocation.
The proof of concept launched Windows Calculator. XBOW’s technical account said Google confirmed that the chain “popped calc.” The final Crashpad stage used existing Control Flow Guard-valid functions and a normal call-and-return sequence to work with Control Flow Guard and the user shadow stack on the tested systems.
Google fixed the vulnerabilities
Google’s Chrome Stable Channel update announced Chrome 152.0.7977.64 for Linux and 152.0.7977.64/.65 for Windows and Mac. The release notes listed CVE-2026-78952 as a high-severity out-of-bounds write in Crashpad and credited Brendan Dolan-Gavitt of XBOW with reporting it on August 13, 2026.
XBOW’s advisory said Google fixed CVE-2026-78952 in Chrome 152.0.7977.65 on August 25, 2026. Google later announced Chrome 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux in a subsequent Stable Channel update.
XBOW said all three bugs in the awarded chain were fixed. The company advised Chrome users to relaunch the browser after an update because the fixes take effect only after Chrome restarts.
Speed, cost and impact
XBOW estimated that the awarded six-day effort used about $40,000 in AI compute and API costs, based on archived Codex logs. Before the fixes, XBOW estimated that about one billion people running Chrome on Windows worldwide were in the path of this type of attack.
XBOW said an attacker who gained the resulting access could install malware, ransomware or spyware, establish a foothold for lateral movement, or steal credentials and files. The company said the vulnerabilities were reported through Google’s official vulnerability reward program, Google engineers reproduced and confirmed the exploit, and the chain was never used against Chrome users.
XBOW’s technical account described the change in development time:
“Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days.”
XBOW
XBOW founder and CEO Oege de Moor said:
“This disclosure highlights the speed and what is possible when human ingenuity and decades of offensive security experience is combined with the world’s most capable models. Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path,”
Oege de Moor, Founder and CEO, XBOW
De Moor also said:
“It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months. Attackers are working with this speed and ease, and defenders need a similar pace to find the exploitable paths among their many findings.”
Oege de Moor, Founder and CEO, XBOW
Clint Gibler, OpenAI’s Head of Cyber Research, said:
“We want to help more defenders find and fix critical vulnerabilities faster,” and “A single XBOW researcher used our models to uncover a chain of vulnerabilities that Google has now fixed. We’re working with security researchers and industry partners to put these capabilities in more defenders’ hands to protect the software people rely on every day.”
Clint Gibler, Head of Cyber Research, OpenAI
Dolan-Gavitt wrote:
“Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!”
Brendan Dolan-Gavitt, XBOW
XBOW said Google’s $250,000 payment was its first Chrome full-chain award under Google’s 2026 rules and the first such award to an autonomous offensive-security platform. XBOW said it would use the award money to fund work securing nongovernmental organizations with its technology.
Sources
About the Author
