Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.

Its researchers built the attack in six days by directing AI agents running OpenAI’s publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $250,000 reward for a full Chrome exploit.

The attack is a full chain: a set of bugs used together to break every layer of Chrome’s protection, from a web page all the way to the computer.

Chrome runs web page code inside two nested sandboxes, the barriers that stop a hacked page from reaching the rest of the machine. The chain crossed both. The result was code running outside Chrome on Windows, with no need for the user to click or download anything.

All three bugs are now fixed, and XBOW says they were never used against Chrome users. The two that carry public identifiers were fixed in Chrome 152.0.7977.65 on August 25 and 152.0.7977.82 on September 3.

Chrome updates on its own, but the fix only takes effect after the browser restarts, so the action is to relaunch Chrome and confirm the version is 152.0.7977.82 or later.

The six days are the headline, and they need their frame. XBOW built the awarded chain between Sunday, August 2, and Friday, August 7, during the Black Hat and DEF CON conferences in Las Vegas. That sprint followed months of earlier work: the company set the challenge at a January staff meeting in Malta, and its first full Chrome chain took two months to complete.

One version of the awarded chain nearly failed when a bug it relied on turned out to be one Google already knew about. XBOW had built the exploit in swappable parts with backups ready, so it replaced that part and the chain held. By the company’s own count of its usage logs, the six-day run cost about $40,000 in AI charges.

XBOW also drew a line between what the AI did and what people did. The AI agents searched Chrome’s source code, tested ideas, built proofs of concept, and wrote the first drafts of the exploit. The researchers chose the targets, supplied context, challenged the agents’ results, and decided which pieces to join.

One researcher, Brendan Dolan-Gavitt, built the awarded chain with the agents. “Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days,” Dolan-Gavitt wrote.

The three bugs each sat in a different part of Chrome. Google’s own release notes credit Dolan-Gavitt of XBOW for two of them and list the version that fixed each.

• The first bug gave the attacker control of memory inside Chrome’s JavaScript engine.
• The second, in the code that reads animated WebP images, used that control to break out of the engine’s inner sandbox and make one precise write to the computer’s memory.
• The third, in Crashpad, Chrome’s crash handler, which runs outside the sandbox, turned that single write into full code execution on the machine.

Both identified bugs are rated high severity and need the user to load a page. The WebP bug was fixed in the same Chrome 152 cycle, but no public identifier can be confirmed for it: the one XBOW’s announcement gives the WebP stage, CVE-2026-85045, is the identifier Google and XBOW’s own technical write-up both assign to the V8 bug.