AI-Assisted Team Breaks Chrome Sandbox in Six Days, Earns $250,000 Bounty

Researchers chain three zero-days to threaten one billion users; Google issues patches

By LineZotpaper

Published15 October 2026

Read Time3 min

Security startup Xbow, using OpenAI's GPT-5.6 Sol model, chained three Chrome zero-day vulnerabilities into a full exploit that escapes the browser's sandbox on Windows, potentially affecting one billion users. Google patched the flaws and paid a $250,000 bounty, the company's top reward for a full-chain Chrome exploit.

Security researchers at startup Xbow used OpenAI's GPT-5.6 Sol model to chain three zero-day vulnerabilities in Chrome into an exploit capable of executing code outside the browser's sandbox on Windows machines. Xbow estimates the flaw could affect about one billion users worldwide.

Google fixed all three issues and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit. The four researchers—Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers—spent just six days during the Black Hat and DEF CON conferences and about $40,000 in token charges to discover the vulnerabilities and build the attack chain.

"The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive," Xbow CEO and founder Oege de Moor said on Tuesday. "A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days."

In a separate technical writeup, Dolan-Gavitt detailed the division of labor between humans and AI agents. The agents, using OpenAI's GPT-5.6-Sol, searched source code, tested hypotheses, and developed proofs of concept and exploit stages. Meanwhile, the researchers chose targets, provided context, challenged the agents' results, and decided which attack components to chain.

"We did apply a fair bit of our own human expertise and judgment," he wrote.

The exploit crosses two security boundaries in three stages. The chain combines a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. The first vulnerability is in Maglev, V8's mid-tier optimizing compiler, giving attackers read and write access throughout V8's pointer-compression cage. The second stage exploits a property the V8 sandbox deliberately does not enforce, and the final overflow in Crashpad crosses the outer process boundary to achieve unsandboxed code execution on the host.

While Google patched all three issues, Chrome installs updates on its own, but a fix only takes effect once the user relaunches the browser. Users should ensure they run version 152.0.7977.82 or later.

The time and money spent to achieve the full chain illustrate that "the bar is significantly lower" for attackers armed with LLMs, Dolan-Gavitt wrote. "Defend accordingly."

Analysis

Why This Matters

Demonstrates that AI models can dramatically accelerate complex exploit development, reducing time from months to days.
Highlights the real-world risk to billions of Chrome users, even if patches are now available.
Raises questions about the security implications of publicly available AI models for both defenders and attackers.

Background

Browsers like Chrome rely on layered sandboxes to contain code execution, with the V8 sandbox nested inside the OS process sandbox. Full-chain exploits that escape both are rare and highly valued, with vendors offering top bounties for such work. This incident is an example of AI-assisted vulnerability research, where models like GPT-5.6 Sol are used to automate parts of the discovery and exploitation process.

Key Perspectives

Xbow and security researchers: The use of AI agents can significantly reduce the time and cost of finding and exploiting vulnerabilities, making it easier for defenders to stay ahead of threats. Google and browser vendors: They face pressure to patch quickly and increase bounties as AI lowers the barrier for attackers, while also benefiting from responsible disclosure. Critics and skeptics: Concerns include the potential for malicious actors to use similar AI techniques for offensive purposes, and the risk that AI-generated exploits could outpace human patch cycles.

What to Watch

The next major browser vulnerability disclosure and whether LLM-assisted exploits become more common.
Google's response in terms of bounty increases or changes to sandbox design.
Adoption of AI pen-testing tools by other security firms and the evolution of defensive strategies.

Sources

Security researchers spent 6 days doing their Chromework, built 1B user exploit — www.theregister.com - Articles