XBOW receives top Chrome reward for six-day AI-assisted exploit

Security firm XBOW received Google’s maximum $250,000 Chrome Vulnerability Reward Program payment after reporting a full exploit chain that combined three previously unknown flaws. The company said a single researcher, Brendan Dolan-Gavitt, used AI agents running OpenAI’s publicly available GPT-5.6 Sol model to help produce the chain in six days, with usage logs indicating about $40,000 in AI charges.

The chain allowed code execution on a Windows computer when a user loaded a malicious web page. It required neither a click nor a download. Google confirmed the flaws, fixed them, and XBOW said the bugs had not been used against Chrome users.

A chain across Chrome’s protective boundaries

A full Chrome chain combines multiple vulnerabilities to move from web content to the underlying machine. Chrome isolates page code behind two nested sandboxes. XBOW’s reported chain crossed both layers before reaching code execution outside the browser on Windows.

The first stage was a V8 JavaScript-engine flaw, CVE-2026-85045. It gave the attacker control of memory inside the engine. The second stage involved Chrome’s animated-WebP image decoder and used that control to escape V8’s inner sandbox and perform one precise memory write.

The third stage targeted Crashpad, Chrome’s crash handler, which runs outside the sandbox. XBOW said this converted the single write into full code execution. Google’s release notes credit Dolan-Gavitt for CVE-2026-85045, fixed in Chrome 152.0.7977.82 on September 3, and CVE-2026-78952 in Crashpad, fixed in version 152.0.7977.65 on August 25. Both identified issues are rated high severity.

The WebP component was fixed during the Chrome 152 release cycle, but no public identifier can be confirmed for it. XBOW’s announcement associates CVE-2026-85045 with that stage, while Google and XBOW’s technical write-up assign that identifier to the V8 flaw.

Speed claims need context

The six-day figure covers a sprint from August 2 to August 7 during the Black Hat and DEF CON conferences in Las Vegas, rather than the project’s entire history. XBOW set the challenge at a January staff meeting in Malta, and its first complete Chrome chain took two months. During the awarded effort, the team replaced a component after discovering that Google already knew of a bug on which that version depended.

XBOW described a division of work in which agents searched Chrome source code, tested ideas, produced proofs of concept and drafted exploit code. Researchers selected targets, supplied context, challenged outputs and chose which components to combine. The case sits alongside Chrome patch volume and update management in showing why Chrome’s large patch volume demands disciplined update management rather than reliance on a single security control.

Patch status remains the operational issue

Google’s updated 2026 reward rules offer up to $250,000 for a full-chain report and limit such awards to four a year. XBOW calls its payment the first full-chain reward under those rules. Before fixes shipped, the company estimated that about 1 billion people using Chrome on Windows could have been exposed to this attack class.

Chrome updates automatically, but protection takes effect only after a browser restart. Businesses should relaunch Chrome, verify that endpoints run 152.0.7977.82 or later, and ensure browser-update processes include restart and version-compliance checks.