AI Agents Used to Discover Full-Chain Chrome Exploit, Earning Researchers $250,000 Bounty
XBOW researchers leveraged GPT-5.6 AI agents to discover a complex, full-chain exploit for Google Chrome in just six days, earning a $250,000 bounty from Google.
Security researchers at XBOW have been awarded a $250,000 bounty by Google for successfully developing a full-chain exploit targeting the Chrome browser. The significant achievement was accomplished in a remarkably short timeframe of six days, utilizing advanced AI agents powered by OpenAI's GPT-5.6 Sol model, with an estimated computing cost of $40,000.
The exploit chain successfully linked three distinct vulnerabilities to achieve code execution outside the browser's sandbox environment. This type of exploit is particularly concerning as it allows a malicious actor, through a compromised webpage, to gain control over the user's system beyond the isolated rendering process of the browser. XBOW demonstrated the exploit against a Windows test system, though they reported no evidence of it being used in the wild against actual users.
The first vulnerability resided within V8, Chrome's high-performance JavaScript engine. XBOW identified a flaw in the Maglev compiler that permitted separate JavaScript objects to share a mutable number during deoptimization. This process, where V8 transitions from optimized to less optimized code, could be manipulated to mislead the optimized code, granting the exploit memory access within V8's protected regions.
The second component of the exploit chain targeted the handling of animated WebP images. A flaw in the decoder allowed it to incorrectly use frame data from one image while processing modified data from another. This data mismatch resulted in an out-of-bounds write vulnerability, enabling the exploit to break out of the V8 sandbox.
The final vulnerability was found in Crashpad, Chrome's built-in crash reporting system. On Windows, Crashpad could attempt to re-read memory using a length derived from the rest of a page, under the assumption that the renderer's memory would remain unchanged. XBOW's exploit, however, manipulated page access during this retry phase, causing an oversized read and leading to memory corruption in the handler, which operates outside the renderer sandbox.
XBOW emphasized that while AI agents were instrumental in discovering the vulnerabilities, human oversight remained critical. Researchers guided the AI, selected targets, divided tasks, verified AI-generated results, and prepared contingency plans. The team had to replace an initial exploit component after Google indicated it was already known, showcasing the adaptability required in modern exploit development.
Google's Chrome Vulnerability Reward Program offers substantial rewards for such sophisticated exploits, requiring a working demonstration and adherence to responsible disclosure practices. The $250,000 award acknowledges the discovery of a significant security flaw that could have potentially impacted the estimated one billion users of Google Chrome worldwide.
This incident highlights the accelerating pace of vulnerability discovery driven by AI. While AI tools can significantly shorten the time needed to find complex flaws, the need for human expertise in guiding these tools, verifying findings, and coordinating fixes remains paramount for effective cybersecurity.
The new article provides further technical details on the three zero-day vulnerabilities chained together to create the exploit. It clarifies that CVE-2026-85045 and CVE-2026-78952 were the identified bugs, with a third bug in the Animated-WebP image decoder lacking a public identifier. Additionally, it highlights that the exploit was developed between August 2nd and August 7th, costing approximately $40,000 in AI compute charges, and emphasizes the collaborative human-AI effort in its creation.