Google has awarded cybersecurity company XBOW $250,000 for developing an artificial intelligence-assisted exploit that breached Chrome’s security barriers and enabled code execution on Windows computers, marking the first full-chain payout under its updated 2026 vulnerability reward programme.XBOW disclosed the award on October 13, confirming that researchers combined three previously unknown vulnerabilities to escape Chrome’s renderer sandbox. Google has patched all three flaws, and the company said there was no evidence that the exploit had been used against browser users.
The attack chain was developed over six days in August using AI agents powered by OpenAI’s GPT-5.6 Sol model, working alongside human security researchers. XBOW estimated the computational cost at approximately $40,000, substantially below the $250,000 reward.
The demonstration showed how visiting a specially crafted webpage could potentially allow an attacker to execute code outside the browser’s protective environment without requiring additional downloads or user interaction.
XBOW estimated that approximately one billion Chrome users operating Windows devices could have been exposed before the vulnerabilities were corrected. That figure represents the potential reach of the affected software rather than confirmed compromises.
Google introduced updated full-chain reward provisions in April 2026, offering substantial incentives for researchers demonstrating attacks capable of crossing multiple browser security boundaries. The XBOW submission became the first to receive the programme’s $250,000 full-chain award under those rules.
The vulnerabilities affected three separate Chrome components: the V8 JavaScript engine, the animated WebP image decoder and Crashpad, the browser’s crash-reporting system.
The first vulnerability enabled manipulation of memory within V8. The second allowed researchers to overcome an additional isolation mechanism, while the third exploited Crashpad to achieve code execution beyond the renderer sandbox.
Together, the weaknesses demonstrated how separate software defects could be combined to defeat protections designed to prevent malicious webpages from accessing operating-system resources.
Two vulnerabilities have publicly identified security references. CVE-2026-85045 affected V8, while CVE-2026-78952 concerned Crashpad. Google addressed the identified flaws through Chrome 152 security updates distributed in August and September.
XBOW said the research involved security specialists Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers. Dolan-Gavitt worked directly with AI agents to assemble the awarded exploit chain.
The AI systems examined Chrome source code, investigated possible vulnerabilities, tested hypotheses and generated preliminary exploit components. Human researchers selected targets, evaluated the findings, supplied technical direction and determined how individual vulnerabilities could be combined.
The company emphasised that the achievement depended on collaboration rather than entirely autonomous exploitation. Researchers exercised judgement when choosing attack paths and validating results produced by the models.
An earlier version of the exploit chain encountered a setback after Google informed the researchers that one vulnerability was already known. The team substituted an alternative component, preserving the overall attack sequence.
That flexibility proved important because the reward programme requires qualifying submissions to meet its eligibility conditions, including the novelty of the reported vulnerabilities.
XBOW founder and chief executive Oege de Moor said the development demonstrated how publicly accessible AI technology could accelerate sophisticated vulnerability research.
The company had initially required approximately two months to develop an earlier Chrome exploit chain. Its subsequent six-day effort reflected accumulated research experience alongside the use of AI-assisted investigation.
The six-day development period ran from August 2 to August 7, coinciding with the Black Hat and DEF CON cybersecurity conferences in Las Vegas.
Security specialists have increasingly examined whether advanced AI models can reduce the expertise, time and resources required to discover exploitable software defects. The XBOW demonstration provides a documented example involving a widely deployed browser and multiple security boundaries.
However, the experiment does not establish that AI independently discovered and weaponised the vulnerabilities. Its outcome relied on experienced researchers directing the systems and assessing their technical output.
The Cloud Security Alliance, examining the disclosure, highlighted the importance of distinguishing the six-day development effort from the longer preparation and experimentation that preceded it.
The organisation also observed that the computational expenditure was reconstructed from archived usage records, without sufficient published detail to independently break down the model’s individual operating costs.
Chrome users have been advised to install available browser updates and restart the application so security corrections become effective. Organisations managing large browser deployments must also ensure that updated versions have been activated across their devices.
Google’s vulnerability reward arrangements provide financial incentives for responsible disclosure, allowing researchers to submit security findings before publishing technical details.
XBOW released its technical account after the affected vulnerabilities had been corrected, describing the separate exploit stages and the interaction between human researchers and AI agents.
The company’s demonstration used a Chrome browser running on Windows, with the successful attack illustrated by launching the operating system’s Calculator application outside the browser sandbox.
Topics
Technology