XBOW Chrome Full-Chain Exploit Built With GPT-5.6 Earns $250,000 Google Bounty

Autonomous offensive security company XBOW said on October 13, 2026 that Google paid it a $250,000 bounty after its researchers, assisted by AI agents powered by OpenAI's GPT-5.6 Sol model, produced a full-chain exploit of Chrome. The Seattle-based startup said the payout marks the first $250,000 Chrome full-chain reward granted since Google's updated Vulnerability Reward Program rules took effect in April 2026, and CEO Oege de Moor wrote on X that it was only the second time in Chrome's history Google had paid that amount for a full chain.

The XBOW Chrome full-chain exploit combined three previously unknown vulnerabilities in Chrome for Windows and could have allowed an attacker to execute arbitrary code beyond the browser's sandbox protections, set off by a victim simply loading a web page. XBOW estimates the flaws affected roughly one billion Chrome users on Windows globally, a figure FourWeekMBA noted is the company's own estimate.

Six days in Las Vegas

The team built the exploit between August 2 and August 7, 2026, while in Las Vegas for the Black Hat and DEF CON security conferences, according to a blog post XBOW published on October 13. Researcher Brendan Dolan-Gavitt worked with the AI agents through the campaign, with de Moor directing the effort.

XBOW put the compute bill for the six-day campaign at roughly $40,000 in API charges, a reconstruction Dolan-Gavitt produced from archived Codex logs. That is a fraction of the $250,000 payout, and the company said that in the era before large language models, a four-person team would typically need somewhere between six and nine months to assemble a comparable Chrome full chain. XBOW's first submission attempt took two months, Dolan-Gavitt wrote, and Google told the team it already knew about one of the bugs in that first chain.

De Moor wrote that a veteran of a three-letter intelligence agency told him that identifying this class of vulnerability and gaining total access once took his team half a year. The model involved, GPT-5.6 Sol, is publicly available rather than a restricted lab tool, a point de Moor said was deliberate: the team picked a model anyone can access, not a specialized security model.

How the three-bug chain worked

Chrome is built in layers, so an attacker who finds a single bug might take over a web page but get no further. A full chain strings multiple bugs together so that each one unlocks the next barrier, carrying the attacker from an ordinary web page all the way to the underlying computer. XBOW's chain crossed two sandbox boundaries in three stages on Windows.

The first stage exploited a bug in the Maglev compiler inside V8, Chrome's JavaScript engine, where a mutable boxed number was reused during deoptimization, handing the exploit read and write reach across V8's pointer-compression cage, the first layer of Chrome's security architecture. The second bug, tracked as CVE-2026-85045, sat in Chrome's animated WebP image decoder, where cached geometry data did not match changed image bytes, producing one precisely targeted write to native memory outside the cage.

The final stage hinged on CVE-2026-78952, a flaw in Crashpad, the component Chrome uses to handle crashes, which treated a failed read from a supposedly frozen renderer process as a stable, trustworthy observation. Abusing it converted the second stage's native memory write into unrestricted code execution beyond the sandbox. In the end, code ran outside Chrome's sandbox with no downloads, no clicks and no user interaction beyond navigating to a page.

Viewed individually, each of the three flaws might have been rated only low or moderate in severity, according to SMBtech. Linked in sequence, they yielded a full escape from the sandbox, a class of browser vulnerability that security researchers and attackers alike rank among the most severe.

Humans set the strategy

XBOW's own account describes a division of labor between the researchers and the agents. The agents combed through Chrome's source code, ran experiments on candidate ideas, assembled proofs of concept and drafted the first versions of the exploit, while the researchers chose targets, supplied context, checked the agents' work and redirected them.

According to the company, a single judgment call by the humans made the difference: the exploit was assembled from three separate modules, and each module had a backup option, so any bug that turned out to be already known could be replaced without starting over. Dolan-Gavitt wrote that this design rescued the chain when its first V8 sandbox escape turned out to be a duplicate. Alongside Dolan-Gavitt, researchers Andres Luksenberg, Baul Lee and Willem Pinckaers took on the challenge.

XBOW said it believes that within a year each of the three bugs could be found by agents working on their own. Dolan-Gavitt cautioned that the outcome does not put a Chrome chain within reach of just anyone willing to spend that much time and money, though in his view the barrier has dropped considerably. He also wrote that bug collisions are a major risk now that everyone, Google included, is pointing LLMs at codebases like Chrome.

Google's response and the disclosure

XBOW reported all three bugs to Google through the official vulnerability reward program, and Google confirmed the findings and paid the reward about a month after submission. Google went on to reproduce the exploit itself, verify the vulnerabilities and release patches, and none of the flaws were ever turned against Chrome users. Public root-cause reports for all three vulnerabilities have been made available.

De Moor framed the disclosure in terms of what the combination of human expertise and AI capability now makes possible in offensive security research, according to SMBtech. He pointed to the timeline and cost as indicative of a broader shift in the economics of vulnerability research, and argued that restricting access to powerful models is the wrong question because the model XBOW used is already public.

OpenAI president and co-founder Greg Brockman quoted de Moor's post on X the same day, restating the six days, $40,000 of compute with GPT-5.6 Sol and the estimated one billion affected users, and writing that it highlights the opportunity for defenders to use these tools to secure their software. Clint Gibler, OpenAI's head of cyber research, highlighted the defensive implications of the work, SMBtech reported.

What XBOW does next

XBOW's stated position is that defenders need to match the speed at which attackers can now operate, and that autonomous offensive security platforms are a way to do that. The company said the tools that found these bugs are available to anyone who defends software, and that defenders have an advantage attackers never will: they can test their own code first.

XBOW said it will use the $250,000 award to fund efforts to secure non-governmental organizations using the company's technology. It is also developing an autonomous product for testing compiled software, such as desktop applications, servers and embedded devices, and partnering with large organizations to design that product.

XBOW was founded in 2024 by de Moor, who previously created GitHub Copilot. According to the company, it has submitted more than 1,060 vulnerabilities across real-world production targets. XBOW does not give a total cost for the Chrome campaign including researcher time, and it has not said how much compute went into the first, rejected chain.

Conclusion

XBOW's disclosure establishes that a small team pairing human researchers with publicly available AI agents can produce a Chrome full-chain exploit in days rather than months, and that Google will pay its top tier for the result. The three vulnerabilities are patched, the $250,000 bounty is paid, and the root-cause reports are public. The next concrete steps are XBOW's planned use of the award to fund security work for non-governmental organizations and its development of an autonomous product for testing compiled software such as desktop applications, servers and embedded devices.

Frequently Asked Questions

How much did Google pay XBOW for the Chrome full-chain exploit?

Google paid XBOW $250,000 for the full-chain exploit. XBOW says it is the first award of its kind under Chrome Vulnerability Reward Program rules that took effect in April 2026, and CEO Oege de Moor says it is only the second time Google has paid that amount for a Chrome full chain.

What were the three Chrome vulnerabilities XBOW chained together?

The chain combined a bug in the Maglev compiler inside V8, Chrome's JavaScript engine; a flaw in the animated WebP image decoder tracked as CVE-2026-85045; and a memory safety issue in Crashpad, Chrome's crash handler, tracked as CVE-2026-78952. Together they produced a full sandbox escape on Windows.

How long did the XBOW Chrome exploit take and what did it cost?

The team built the exploit in six days, from August 2 to August 7, 2026, during the Black Hat and DEF CON conferences in Las Vegas. XBOW reported compute costs of around $40,000 in API fees, reconstructed from archived Codex logs, a fraction of the $250,000 payout.

Were Chrome users attacked with these vulnerabilities?

No. XBOW reported all three bugs to Google through the official vulnerability reward program, the flaws were never used against Chrome users, and Google reproduced the exploit, confirmed the vulnerabilities and shipped fixes. Public root-cause reports for all three vulnerabilities have been made available.

Which AI model did XBOW use to find the Chrome bugs?

XBOW's agents ran on OpenAI's GPT-5.6 Sol model, which is publicly available rather than a restricted or specialized security model. De Moor said the team deliberately chose a model anyone can access, and he argues that restricting powerful models is the wrong question because the model is already public.