XBOW Builds a Chrome Full-Chain Exploit in Six Days for $40K in Tokens, Wins Google's $250K

TL;DR

XBOW published the technical write-up of a Chrome full-chain exploit on October 13: three previously unknown bugs that take a web page from JavaScript in an ordinary tab to a Calculator window running outside the renderer sandbox on Windows. One XBOW researcher built it with agents running OpenAI's GPT-5.6 Sol between Sunday, August 2 and Friday, August 7, for roughly $40,000 in API charges reconstructed from Codex logs. Brendan Dolan-Gavitt wrote the post and is the reporter Chrome's release notes credit. Google reproduced it, fixed all three bugs in Chrome 152, and paid $250,000, which XBOW calls the first full-chain Chrome award under the Vulnerability Reward Program rules Google rolled out this spring. Dolan-Gavitt's comparison: before LLMs, a team of four would have needed six to nine months.

What the chain does

A Chrome full chain has to clear three walls, and XBOW's agents found a bug for each one.

• Stage 1, V8 Maglev: during deoptimization, the compiler treated a mutable HeapNumber as an immutable constant and shared it between objects. That gave read and write access inside V8's pointer-compression cage. The fix, merged August 19, makes every materialization allocate a fresh box.
• Stage 2, animated WebP: a transferred ArrayBuffer could still be modified through a view V8 had not detached, so two WebP files could interact inside the decoder. Cached frame geometry from one file combined with the bytes of the other produced a single chosen native write outside the cage. Chromium tracks it as bug 548509153, with fixes merged August 21 and September 8.
• Stage 3, Crashpad: the crash handler treated a failed read from a supposedly frozen renderer as stable evidence. A freeze-exempt thread changed page protections during the retry, the handler overflowed, and the attacker got code execution in the unsandboxed crash process. Chrome's August 25 release notes list it as CVE-2026-78952, out of bounds write in Crashpad, reported by Dolan-Gavitt on August 13 and fixed in 152.0.7977.65.

Chrome's September 3 release notes credit Dolan-Gavitt with a second entry, CVE-2026-85045, attached to bug 547819997, the Maglev issue, reported August 17 and fixed in 152.0.7977.82. XBOW's press release attaches that CVE number to the WebP stage instead. Go by the bug IDs, which Chrome's own commits cite.

Six days, one human, and a stressful afternoon

The campaign was split into parallel tracks: a broad vulnerability search, V8 memory corruption, V8 sandbox escape, renderer sandbox escape, and integration. The agents, driven by GPT-5.6 Sol, "searched source code, tested hypotheses, built proofs of concept, and developed exploit stages." The human "chose targets, supplied context, challenged results, redirected searches, and decided which components to join." In the Hacker News thread, Dolan-Gavitt (posting as moyix) put a number on the search: "We actually found ~11 vulns throughout those 6 days; we submitted three as a full chain, the middle stage collided, and we submitted one of the backups as a replacement."

That collision is the drama. The first version's V8 sandbox escape used a Gin bug that duplicated Chromium issue 542670566, already in Google's queue. After "a very stressful few hours," the team swapped in the animated WebP stage from the backup pile, and Google confirmed the new chain popped calc. Having a spare sandbox escape lying around is the kind of thing that only happens when finding bugs is cheap.

It was also not XBOW's first attempt. An earlier chain, built collaboratively over two months and presented by Andrés Luksenberg at OffensiveCon Tokyo, died when its final stage collided with a bug Google had found internally. Per moyix, "the first working full chain was entirely invalidated and they fixed all the bugs involved in that chain," so the August work started from scratch, "greatly helped by being able to reference exploit techniques from the other chain." The team itself only existed from about May.

The economics

Roughly $40,000 in API charges bought the six days. Google paid $250,000. Oege de Moor, XBOW's founder and CEO (and the creator of GitHub Copilot, per the company), framed it in the press release: "It only took an estimated $40,000 of compute and six days." Clint Gibler, OpenAI's head of cyber research, added the line the model vendor wanted on record: "A single XBOW researcher used our models to uncover a chain of vulnerabilities that Google has now fixed." XBOW says the money goes to its work securing NGOs. The company raised a $120 million Series C at a valuation above $1 billion in March, so the bounty is a rounding error on the balance sheet and the whole point of the press cycle.

The reward lands under rules Google changed this year. Its Chrome VRP revision, covered by SecurityWeek on May 1, phased out the bonuses for arbitrary read/write and remote code execution bugs "following a surge in AI-driven submissions," dropped the base memory-safety reward to $500 with multipliers, and kept a full chain at up to $250,000. Google said it was emphasizing "categories that represent the highest risk to our users" and that its "internal tooling has also evolved to help us automatically explain and suggest fixes for bugs." So the program now pays little for the kind of bug AI finds in bulk and a lot for the kind of chain AI, apparently, now also builds. XBOW dates the rules to April; the first award under them went to a company whose product is the thing the rules were reacting to.

What the agents were actually good at

Dolan-Gavitt's closing analysis is the useful part for anyone running agents against a large C++ codebase. Two of the three bugs are invariant violations: a value assumed immutable that was not, a renderer assumed frozen that was not. His read is that this is where LLMs excel, because the question "what does this code assume, and where is that assumption not enforced" is a reading-comprehension task across millions of lines, and models read faster than people. Think of it as a tireless junior who never gets bored of the fourth hour of grepping for every caller of a function. The exploitation craft, the modular "island hopping" loader and the technique library from the first chain, still came from XBOW's Native Team.

The write-up also says collisions are now the main business risk for a VRP reporter. If finding bugs is cheap for XBOW, it is cheap for Google's internal tooling too, which is why the first chain's final stage and the second chain's middle stage both hit bugs Google already had. The replacement stage saved the payout.

Caveats

• The six-day and $40,000 figures are XBOW's, reconstructed from archived Codex logs, and the 6-9 month baseline is an estimate. Secondary coverage repeats XBOW's numbers without independent verification.
• Google has not published a statement. What is verifiable from Google's side: the three Gerrit changes, the two release-note credits to Dolan-Gavitt, and the MITRE records for CVE-2026-78952 and CVE-2026-85045.
• XBOW's "estimated billion users" is its own framing of the Windows Chrome install base. None of the bugs were used against real users, per XBOW.
• Commenter gruez notes that disabling the JIT (an option in Edge, and partially via Chrome's V8 optimizer toggle) would have blunted stage one. That is a mitigation for the people who already run that way.

Key Takeaways

• XBOW turned JavaScript in a Chrome tab into code execution outside the sandbox with three new bugs, built August 2-7 by one researcher plus GPT-5.6 Sol agents.
• Cost about $40,000 in API charges; Google paid $250,000, which XBOW calls the first full-chain Chrome award under the 2026 VRP rules.
• All three fixes are public on Chromium Gerrit and shipped in Chrome 152.0.7977.65 (August 25) and .82 (September 3).
• The agents found about 11 bugs in six days; a spare sandbox escape rescued the chain when the first one collided with a known issue.
• Google's spring VRP revision cut rewards for bugs AI finds in bulk and kept $250,000 for full chains. XBOW's result says the chains are getting cheap too.
• Pre-LLM baseline per XBOW: a team of four, six to nine months. Treat that as the company's estimate, not a measurement.

Sources: XBOW, "Zero to Calc in Six Days", XBOW announcement, XBOW press release (Business Wire), Chrome Releases, August 25, Chrome Releases, September 3, V8 change 8255554, Chromium change 8266257, Chromium change 8267322, CVE-2026-78952, Hacker News thread, SecurityWeek on the 2026 Chrome VRP rules, Help Net Security, XBOW Series C