Security
XBOW Won Google's Top Chrome Bounty With a Public OpenAI Model. The Exploit Cost $40,000 to Build
Google's Chrome Vulnerability Reward Program paid XBOW $250,000 for a three-bug chain that ran code on Windows from a loaded web page. XBOW says one researcher and AI agents running OpenAI's publicly available GPT-5.6 Sol built it in six days for roughly $40,000 in compute — and that ratio, not the payout, is the story.
MAI
XBOW disclosed on 13 October that Google's Chrome Vulnerability Reward Program had paid it $250,000 for a working full-chain exploit: three previously unknown bugs stitched into one path that ran code on a Windows machine when the user did nothing but load a web page. No click, no download. The company says it is the first full-chain Chrome award under the rules Google rewrote in 2026, and the first to an autonomous offensive security platform.
The payout is not the number that matters. The invoice is. XBOW says the awarded chain was built between 2 and 7 August by a single researcher directing AI agents, and that the agents' usage came to roughly $40,000. The model doing the work was OpenAI's GPT-5.6 Sol — not a bespoke offensive system, not a restricted build handed to vetted partners, but the model anyone with an API key can call.
What was in the chain
| Component | Identifier | Role in the chain |
|---|---|---|
| V8 JavaScript engine | not published | initial foothold in the renderer |
| Animated-WebP image decoder | CVE-2026-85045 | second stage |
| Crashpad crash handler (Windows) | CVE-2026-78952 | escape from the sandbox |
The mapping is worth a caveat: XBOW's release attaches CVE-2026-85045 to the WebP decoder bug, while The Hacker News attributes that identifier to the V8 bug and reports no public identifier for the decoder. Both agree on the three components and on CVE-2026-78952 for Crashpad.
Google confirmed and fixed all three. The fixes shipped inside the Chrome 152 cycle, the last of them in 152.0.7977.82 according to The Hacker News. Chrome applies updates only on restart, so the action for a reader is narrow and worth doing now: relaunch the browser and confirm the version is 152.0.7977.82 or later.
XBOW says none of the three bugs was ever used against Chrome users, and a bounty recognises a report, not a compromise. The billion-user figure circulating with this story is XBOW's own estimate of Chrome-on-Windows exposure before the patches, not a count of anyone harmed.
Who did what
XBOW's own account is careful about the division of labour, and the care is the most informative thing in it. Four named researchers — Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers — chose the targets, set strategy, checked what the agents produced and redirected them. The agents read Chrome's source, tested hypotheses, built proofs of concept and drafted the exploit.
The six days also sit on top of a year of scaffolding. The project was set at a company all-hands early in 2026. The first full chain took about two months. One version nearly died when Google reported that a bug it depended on was already known internally, and the team swapped in a spare — they had built each of the three stages with a backup precisely so a collision would not sink the whole effort. That is engineering management, not model magic, and reading this as "the AI found a Chrome exploit" gets the causality wrong.
Why the cost line is the story
A quarter-million-dollar bounty on the hardest-hardened consumer software in the industry is Google's own statement of what this class of work is worth. XBOW produced it for about a sixth of that, in six days, with one person at the wheel. Chrome's defence in depth — two nested sandboxes, a decade of adversarial attention, a mature reward programme — is what that ratio was measured against.
Oege de Moor, XBOW's founder, drew the conclusion that defenders should sit with:
Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path.
Most organisations still triage findings one at a time. A medium is a medium, a low is a low, and the backlog is sorted by individual score. The capability demonstrated here is not finding a single spectacular bug; it is composing cheap ones into something that is not cheap at all. If the cost of searching for compositions has fallen to this, severity-per-finding stops being a useful way to decide what gets fixed first.
The symmetry nobody has tested
OpenAI's framing is defensive. Clint Gibler, its head of cyber research, said the company is "working with security researchers and industry partners to put these capabilities in more defenders' hands." There is no reason to doubt the intent, and defenders genuinely face a volume problem that this kind of tooling addresses.
The difficulty is that the artefact is identical either way, and the asymmetry does not favour the defender. A defender has to find and close every exploitable path. An attacker needs one, and is not obliged to disclose it, coordinate a fix, or wait for a CVE to be assigned. XBOW also claims its agents could each have found the three bugs unaided within a year — a company claim about its own product, unverified outside the company, and the one claim here that would matter most if it is true.
Google paid a top-tier bounty and shipped the patches. The programme worked as designed. What changed is the price of the thing on the other side of the transaction.
Sources: XBOW: XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days · Business Wire: XBOW Rewarded for Exploit Affecting a Billion Users · The Hacker News: Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days · Cyber Security News: Google Awarded a $250,000 Bounty for a Full-chain Chrome Exploit Found Using GPT-5.6 · Google: Chrome Vulnerability Reward Program rules