XBOW discloses AI-assisted Chrome attack chain built in six days

XBOW disclosed on October 13, 2026, that a researcher working with AI agents built a three-bug attack chain that could escape Chrome’s protections on Windows. The company says Google reproduced the exploit, fixed the vulnerabilities and awarded a $250,000 bounty. The awarded chain took six days to build—but followed an earlier, unsuccessful submission.

The potential attack required only loading a web page, rather than downloading a file or taking another action. XBOW estimates that, before the fixes, roughly one billion Chrome users on Windows were exposed to this class of flaw. It says the vulnerabilities were never used against Chrome users. That is a claim about potential exposure, not a count of victims.

Six days, after a rejected chain

The project began much earlier. In his account of the work, founder and CEO Oege de Moor describes challenging the team at a company gathering in Malta at the start of 2026. The goal was a complete Chrome exploit by the Black Hat cybersecurity conference in August, testing whether its work could move beyond web applications.

Four researchers took on that broader effort: Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers. They worked with OpenAI’s GPT-5.6 Sol and its predecessors. XBOW says it deliberately chose a publicly available model, rather than a specialized security model or one with restricted access.

The first chain did not qualify because Google already knew about one of its bugs, according to XBOW. A design choice helped salvage the work: the researchers had built the exploit as three independent parts, each with an alternative. They could replace a disqualified component instead of rebuilding everything.

While in Las Vegas for Black Hat and DEF CON, Dolan-Gavitt and the agents built the replacement between August 2 and August 7. XBOW puts the compute cost for that awarded chain at $40,000. The six-day window therefore describes this replacement build, drawing on earlier experience—not the entire research project.

The division of labor was explicit. AI agents searched Chrome’s source code, tested ideas, built proofs of concept and drafted the exploit. The researchers set the strategy, selected promising areas, checked the agents’ work and redirected them. XBOW credits the result to both researchers’ judgment and agents’ speed.

Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path

Oege de Moor, founder and CEO of XBOW

Three bugs crossed two protective boundaries

A full-chain exploit links weaknesses that defeat successive layers of protection. Chrome uses sandboxes—restricted environments intended to contain code and limit its access to the rest of a computer. XBOW describes a three-stage route across two sandbox boundaries, ending with a program running outside Chrome’s confinement:

• The first bug affected V8, Chrome’s JavaScript engine. It gave the attacker control of memory inside the engine’s sandbox, establishing the starting point for the chain.
• An animated-WebP image decoder bug, identified as CVE-2026-85045, broke out of that sandbox. It supplied a single precise write to native memory.
• A flaw in Crashpad, Chrome’s crash handler, turned that capability into full code execution. Identified as CVE-2026-78952, it mattered because the crash handler runs outside the sandbox.

The endpoint was not just control over a web page. XBOW says an attacker could use that access to install malware, ransomware or spyware, steal credentials and files, or establish access for movement into other systems. The company says it reported every bug through Google’s official vulnerability reward program before Google reproduced and patched the exploit.

Public models, competing uses

De Moor argues that the falling cost of finding serious vulnerabilities benefits attackers and defenders alike. He rejects restricting powerful models as the answer, pointing to the model’s existing public availability. His preferred response is faster defensive testing: software owners can search their own code before an attacker does.

Greg Brockman amplified the result on X, highlighting six days, $40,000 of compute and an opportunity for defenders to improve security. His post quoted de Moor’s announcement; it was not a separate confirmation of the exploit. XBOW’s more detailed account also makes clear that the agents did not work without human direction.

XBOW predicts that within a year, agents could find each of these three bugs independently. That remains a forecast, distinct from the human-assisted result disclosed here. De Moor’s comparison with six-month intelligence-agency efforts likewise comes from an unnamed veteran’s recollection, rather than a controlled comparison of the same task.

For Chrome users, XBOW’s immediate advice is simpler: keep the browser current and restart it when the Update button appears. Chrome installs updates automatically, the company notes, but the fixes only take effect after the browser is relaunched.