From two months to six days: XBOW's Chrome full chain shows AI's effect on vulnerability hunting

From two months to six days: XBOW's Chrome full chain shows AI's effect on vulnerability hunting

Security company XBOW claims to have built a complete attack chain against Google Chrome — three previously unknown bugs that together enable code execution on Windows simply by loading a web page — in six days, using OpenAI's publicly available model GPT-5.6. Google confirmed the bugs, fixed them, and paid the company's top reward of $250,000 through the Chrome Vulnerability Reward Program. The work was disclosed on October 13, 2026, and according to XBOW cost roughly $40,000 in API calls to the AI model.

The story lands the same day Google announced increased Chrome bug bounty payouts, amid an ongoing recalibration of the economics of vulnerability hunting. And it raises a question defenders worldwide must now grapple with: if the numbers hold, the threshold for building advanced exploits has begun to fall fast.

The Chain, Step by Step

The chain consists of three links, each breaking out of a security boundary in the browser. The details below come from XBOW's own technical write-up, as reproduced by Cybersecurity News, Cryptonomicon, and The Hacker News.

First link: the Maglev compiler in V8. The first bug is in Chrome's V8 JavaScript engine, specifically in the Maglev compiler. The compiler treats a mutable numeric object as if it were immutable — a faulty assumption about state that can change during execution.

Second link: the WebP decoder. The animated WebP image decoder assumes that data passed from JavaScript remains unchanged. This enables an out-of-bounds write that, according to XBOW, provides escape from the V8 sandbox — that is, the attacker gets out of the isolation around JavaScript execution, but remains inside the renderer process.

Third link: Crashpad on Windows. The final link exploits Crashpad, the component that collects crash information and runs outside the sandbox. During an attempt to read memory, the exploit changes the page access permissions mid-attempt, which according to Cybersecurity News "caused an oversized read and memory corruption in the handler outside the renderer sandbox." The result: code execution on Windows outside the browser's sandbox.

The proof of full execution is partly symbolic but unambiguous: the code launches Windows Calculator via the CreateProcessW() API call.

The Timeline: From Malta to Top Reward

The six-day sprint was not the start of the work. According to XBOW's own account, the challenge was set at a company meeting in Malta in January 2026. The company's first complete Chrome chain took two months to build. The rewarded chain was executed in six days, from August 2 to 7, 2026.

One complication along the way: one of the bugs the chain depended on turned out to already be known to Google, and the relevant portion of the chain had to be rebuilt. Once it was complete, XBOW received $250,000 — the maximum reward introduced under the rules Google announced in April 2026.

XBOW researcher Brendan Dolan-Gavitt summed up the contrast, as reported by The Hacker News: "Before LLMs, a Chrome full chain would have taken a team of four around 6–9 months to produce; our first submission took two months. The rewarded one? Six days."

Founder Oege de Moor said in the announcement: "It took only an estimated $40,000 in compute cost and six days for a single researcher to produce a chain that would previously have taken months." The $40,000 figure is the company's own calculation based on its usage logs, not an independently audited number.

Which Model, and What Did It Do?

The work was carried out with GPT-5.6 Sol, a model that is publicly available from OpenAI — not a specially built internal model. That is part of the point: the starting point is supposed to be available to others.

It is nevertheless important to be precise about what the source material supports. This was not a case of a model autonomously "hacking Chrome" — XBOW researchers used the model as a tool in the vulnerability hunt. The sources do not detail to a sufficient degree how the effort was split between AI and humans, and AIMag therefore will not draw a conclusion on that. What is documented is that a company with deep expertise in automated vulnerability hunting used a commercially available model and went from two months down to six days — measured by the company's own figures.

The Bugs, the Fixes, and an Unresolved Identifier

Two of the three bugs have public CVE identifiers, and Google's release notes credit Dolan-Gavitt for two of the three. According to The Hacker News, which builds on Google's release notes and XBOW's technical write-up, the picture is as follows:

Both bugs are rated high severity, and both require the user to load a page.

The WebP bug is in a category of its own. The sources conflict here: Cryptonomicon and Crypto Briefing link CVE-2026-85045 to the WebP bug, while The Hacker News notes that this identifier is assigned to the V8 bug by both Google and XBOW's own technical write-up — and that no public identifier can be confirmed for the WebP bug. AIMag cannot resolve this disagreement on the basis of the available sources and therefore reports it openly. The fix for the WebP bug arrived in the same Chrome 152 cycle, but its exact fix status and identifier remain unresolved in the source material.

The fix versions are also disputed: Cryptonomicon states that Chrome 153 and later protect against the bugs, while The Hacker News refers to the fixes in 152.0.7977.65 and 152.0.7977.82.

Program History and Claims That Cannot Be Verified

XBOW claims this is the first full-chain reward under the April 2026 rules, and Crypto Briefing writes that it was the first full-chain payout in 2026 and only the second in the program's history. These program-history claims trace back in practice to XBOW's own announcement, and the sources contradict each other on the details. AIMag reports them as the company's claim, not as verified facts.

The same applies to the most striking number: XBOW estimates that roughly one billion people running Chrome on Windows were in the risk zone for this type of attack before the fixes were rolled out. This is a company estimate. At the same time, the company says the bugs were never used against Chrome users, and there are no indications in the source material that the techniques have been exploited in the wild.

The Context: A Bounty Economy in Flux

The disclosure lands the same day Google announced an increase in Chrome bug bounty payouts, as reported by SecurityWeek. The base reward for memory safety bugs is quadrupled to $2,000 — a partial reversal after a restructuring in April had cut certain payouts. SecurityWeek describes the background: "AI has been changing the pace and profile of vulnerability discovery, and the tech giant has adjusted its bug bounty programs in recent months."

Taken together, the two same-day events paint a picture of a bounty economy being recalibrated: rewards are being raised at the same time as one company demonstrates — with its own figures — that work that previously took months and a team can now, it claims, be done in a week by one person with a public model.

What This Means for Defenders — and What Remains Open

If XBOW's numbers hold, the message to defenders is the one Dolan-Gavitt himself points to: the threshold for building advanced exploits is falling. A full chain previously reserved for very few actors can in principle be built by more of them — faster and more cheaply. For program managers at software vendors, that means the time window between discovery and exploitation may shrink, and bounty levels must reflect that.

But the variation in the key figures is still the company's own, not independently verified. The open questions include: How much of the six-day speed is due to the model, and how much to XBOW's previous two months of groundwork? How reproducible is the approach for actors without XBOW's expertise? And how long until automated chains of this kind appear in the hands of actors who alert no one?

The safest statement on the documented record: Google confirmed the bugs, paid the top reward, and shipped fixes in August and September. The rest — the speed, the cost, the billion-user estimate — is, for now, the company's own account of its own sprint.