AI‑Driven Research Team Builds Full Chrome Exploit Chain in Six Days Using Three Newly Found Bugs

Security firm XBOW revealed that its researchers chained three previously unknown Google Chrome vulnerabilities into a full exploit that executes code on Windows when a user merely loads a webpage. The attack bypassed both of Chrome’s nested sandboxes, achieving code execution outside the browser with no clicks or downloads required.

XBOW built the exploit chain in just six days using autonomous AI agents powered by OpenAI’s GPT‑5.6 Sol model. Google confirmed all three bugs, patched them, and awarded XBOW the program’s top $250,000 bounty for a full Chrome exploit. The fixes landed in Chrome 152.0.7977.65 (August 25) and 152.0.7977.82 (September 3), and users are advised to relaunch Chrome to ensure they are running version 152.0.7977.82 or later. Release details are available here.

The six‑day sprint took place during Black Hat and DEF CON in Las Vegas, following months of preparation. XBOW’s first full Chrome chain earlier in the year took two months to complete. One version of the awarded chain nearly failed when a bug turned out to be already known to Google, but XBOW’s modular exploit design allowed the team to swap components and preserve the chain. According to usage logs, the six‑day run cost roughly $40,000 in AI compute.

XBOW emphasized the division of labor between humans and AI. The AI agents searched Chrome’s source code, generated ideas, built proofs of concept, and drafted exploit components. Human researchers selected targets, validated results, and assembled the final chain. Researcher Brendan Dolan‑Gavitt noted the dramatic acceleration: “Pre‑LLMs a Chrome full chain would take a team of four around 6–9 months… our first submission took 2 months. The awarded one? six days.”

The exploit chain relied on three bugs in different Chrome components:

Stage 1 – V8 JavaScript engine (CVE‑2026‑85045), fixed in 152.0.7977.82 (Sep 3)
Stage 2 – Animated WebP image decoder (no public CVE), fixed in the Chrome 152 cycle
Stage 3 – Crashpad crash handler (CVE‑2026‑78952), fixed in 152.0.7977.65 (Aug 25)

The first bug granted memory control inside V8. The second used that control to escape the inner sandbox via a precise memory write. The third, in Crashpad—which runs outside the sandbox—turned that write into full code execution on the machine. Both identified bugs are rated high severity and require only that the user load a malicious page.

Google’s Chrome Vulnerability Reward Program pays up to $250,000 for a full‑chain exploit, awarding at most four per year. XBOW says this is the first full‑chain Chrome reward under the 2026 rules and the first awarded to an autonomous security company. Before patches shipped, the vulnerabilities put an estimated one billion Chrome on Windows users at risk.

Founder Oege de Moor highlighted the implications: “It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months.” Dolan‑Gavitt added the warning for defenders: “Six days and $40k is not a lot of time or money when the payoff is a Chrome chain… Defend accordingly.”