# XBOW Used AI Agents to Chain Three Chrome Bugs Into a $250,000 Exploit

- URL: https://usa-24.com/xbow-chrome-exploit-ai-bugs/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-18T21:38:02.202Z
- Updated: 2026-10-18T21:38:02.210Z
- Topics: Google Chrome, AI Security, Zero-Day Exploits, Bug Bounty, Chrome Updates

> XBOW says AI agents chained three Chrome bugs into an exploit that runs code on Windows after a page loads. Google fixed all three and paid $250,000. Update to Chrome 152.0.7977.82 or later.

## Key takeaways

- XBOW says AI agents helped chain three previously unknown Chrome bugs into an exploit that could run code on Windows after a user only loaded a malicious page.
- Google fixed the bugs in Chrome 152.0.7977.65 on August 25 and Chrome 152.0.7977.82 on September 3.
- XBOW says it built the chain in six days, from August 2 to August 7, using OpenAI's publicly available GPT-5.6 Sol model.
- Google paid $250,000, which XBOW says was the first full-chain award under rules Google introduced in April 2026.
- XBOW estimates about $40,000 in compute and roughly 1 billion affected users, and neither figure has been independently verified.

On Tuesday, October 13, the security firm XBOW published a write-up that puts a hard number on how fast AI can help build a browser exploit. According to XBOW, its AI agents helped chain three previously unknown Chrome bugs into one full exploit that could run code on a Windows PC after a user only loaded a malicious web page. Google has fixed all three bugs and paid XBOW a $250,000 bounty.

XBOW, which calls itself an autonomous offensive security company, laid out its account in [its announcement](https://xbow.com/news/xbow-rewarded-for-exploit-affecting-a-billion-users) and a longer technical write-up. [The Hacker News](https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html) and other outlets kept covering the story through October 17. Most of the technical detail still comes from XBOW, so treat it as the company's account until independent researchers confirm it.

## How the XBOW Chrome exploit chained three bugs

Chrome runs web content inside layered sandboxes, which are walls meant to keep a compromised tab away from the rest of the computer. A full chain is a set of bugs that each defeat a different layer. When every layer falls, the browser's containment fails and the attacker reaches the operating system. [The Next Web](https://thenextweb.com/news/xbow-chrome-exploit-gpt-5-6-sol-250000-six-days) describes the XBOW chain the same way.

XBOW says the three bugs sat in three different components. The first was in V8, Chrome's JavaScript engine, and gave the attacker control of memory inside the engine's sandbox. The second was in an animated WebP image decoder and escaped that sandbox. The third was in Crashpad, Chrome's crash handler, and turned that foothold into full code execution.

The most alarming part is how little the victim had to do. Per XBOW, a malicious page loaded in an ordinary tab could lead to code running outside Chrome's sandbox on Windows. No click and no download were required. That separates this chain from attacks that depend on a phishing lure, because the page itself is the trigger.

## How AI agents built the exploit in six days

XBOW says it built the chain between August 2 and August 7, while members of its team were at Black Hat and DEF CON in Las Vegas. The agents ran OpenAI's publicly available GPT-5.6 Sol model. They searched Chrome's source code, tested ideas, built proofs of concept and drafted the exploit itself.

People stayed in the loop. According to XBOW, humans chose the targets, supplied context, checked the results and decided how to join the pieces together. That division of labor is the real story here. The model handled the slow, repetitive search and iteration, while experienced researchers made the judgment calls that turned fragments into a working chain.

The process was not a straight line. An earlier XBOW attempt spent about two months before it collided with a bug Google already knew about, so the team swapped in a different chain. Two months of effort that ends in a dead end is a reminder that AI assistance does not remove dead ends. It shortens how long each one takes to find.

Key dates from the reporting:

- August 2 to August 7: XBOW builds the chain.
- August 25: Chrome 152.0.7977.65 ships fixes for the bugs.
- September 3: Chrome 152.0.7977.82 ships fixes for the bugs.
- October 13: XBOW publishes its write-up and announces the bounty.

## Which Chrome versions fix the three bugs

The fix versions come from secondary reporting that cites Google's release notes, not from Google's notes read directly. Confirm them against Google's own release notes before you rely on them in a compliance report.

Two CVE records are in circulation. CVE-2026-85045 is a V8 race condition fixed in builds before 152.0.7977.82. The CVE record rates it high severity with a CVSS score of 7.5. CVE-2026-78952, a Crashpad out-of-bounds write, carries a CVSS score of 8.3 in one daily cybersecurity roundup.

The mapping between those IDs and XBOW's three stages is disputed. XBOW's announcement assigns CVE-2026-85045 to the WebP stage. [The Hacker News](https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html) and [a DEV Community write-up](https://dev.to/kyo_rush/inside-xbows-6-day-chrome-full-chain-and-the-3-patches-to-check-this-week-4m5j) assign it to the V8 bug and say the WebP bug has no public identifier. Until that is resolved, anyone citing CVE numbers for this chain should say the mapping is still in question.

This chain is separate from a Chrome zero-day Google patched in September. [Qualys ThreatPROTECT](https://threatprotect.qualys.com/2026/09/06/google-chrome-zero-day-vulnerability-exploited-in-the-wild-cve-2026-85046/) reported that CVE-2026-85046 was exploited in the wild, and the Chrome 152 update that month addressed 12 vulnerabilities. That September bug was already being used against people, which is a different situation from the XBOW work.

## What the $250,000 bounty and $40,000 cost really mean

[Crypto Briefing](https://cryptobriefing.com/xbow-gpt-5-6-chrome-exploit-bounty/) reports that $250,000 is Google's maximum full-chain bounty, and that this was the first such award in 2026 and only the second in the program's history. Google introduced new full-chain bounty rules in April 2026, and XBOW says its award was the first under those rules.

The compute cost is the number that should catch a security manager's attention. XBOW estimates the work cost about $40,000 in compute. It also says the bugs could affect roughly 1 billion Chrome users, with its demo targeting Windows. Both figures come from XBOW itself, and neither has independent verification yet.

Even if the cost estimate is off by a wide margin, the gap between roughly $40,000 in compute and a $250,000 payout shows where the economics point. Attackers and well-funded research teams can use the same kinds of models. Bounty programs now have to judge how to handle AI-assisted submissions that arrive quickly.

Patch-timing assumptions that depend on attackers needing months to build a chain deserve a second look. The bounty program gains better-prepared submissions, but defenders lose the slack they used to count on between a fix and a working exploit.

The policy debate is part of the picture. [The Next Web](https://thenextweb.com/news/xbow-chrome-exploit-gpt-5-6-sol-250000-six-days) reports that OpenAI released GPT-5.6 to the public in July and paused a model in August over cyber risk. One commentary cited in that report argues that restricting powerful models misses the point, because XBOW used a model that is already public. That argument deserves a hearing. The model XBOW used was already in public hands, so the question is less about access and more about how defenders respond.

The immediate risk is patch lag, not active attacks. [SecurityWeek](https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/) reports that Google reproduced the bugs, fixed all three and, according to XBOW, found no sign they were used against Chrome users.

## How to check your Chrome version on Windows

Chrome updates itself, but a fix takes effect only after the browser restarts. Follow these steps on a Windows PC:

1. Open Chrome and select the menu in the top-right corner.
2. Choose Help, then About Google Chrome.
3. Confirm the version is 152.0.7977.82 or later.
4. If an update is waiting, relaunch the browser so the fix takes effect.

For IT teams, the steps scale up. Confirm Chrome is updated on every managed Windows endpoint, check the version reported in your device inventory, and review any update policy that holds back browser releases. Teams that also run perimeter devices should review our coverage of [the Palo Alto PAN-OS zero-day](https://usa-24.com/palo-alto-pan-os-zero-day-patch/) and [the Windows shell zero-day that Microsoft patched](https://usa-24.com/windows-shell-zero-day-cve-96951/). Both are reminders that patch timing matters across the whole stack.

## What to watch next

XBOW has not said whether it will publish the full exploit or deeper technical details, and the sources do not settle the question. Google has not said in these sources whether its approach to AI-assisted bounty submissions will change. Those are the two signals that matter most.

A published exploit would let other researchers verify the chain and test their own detections. A rule change from Google would show how a major bounty program plans to handle work that a model can produce in days. Watch the CVE mapping too, because a corrected record will tell defenders which fix covers which stage.

## Frequently asked questions

### Is my Chrome safe from the XBOW exploit?

Google has fixed all three bugs, and the fixes shipped in Chrome 152.0.7977.65 on August 25 and Chrome 152.0.7977.82 on September 3. Check that you are running 152.0.7977.82 or later and relaunch the browser. According to XBOW and Google, there was no sign the bugs were used against Chrome users.

### What is a full-chain exploit?

A full-chain exploit links several bugs so that each one defeats a different layer of protection. Chrome uses layered sandboxes, so a chain can carry an attacker from a web page all the way to the operating system. In the XBOW case, the chain combined bugs in V8, an animated WebP image decoder and Crashpad.

### How much did Google pay for the XBOW Chrome exploit?

Google paid XBOW $250,000. Crypto Briefing reports that this is Google's maximum full-chain bounty and the first such award in 2026, and only the second in the program's history. XBOW says it was the first award under the full-chain rules Google introduced in April 2026.

### Which AI model did XBOW use to build the exploit?

XBOW says its AI agents ran OpenAI's publicly available GPT-5.6 Sol model. The agents searched Chrome source code, tested ideas and drafted the exploit, while humans chose targets, checked results and decided how to combine the pieces. XBOW says the build took six days, from August 2 to August 7.

## Sources

1. [Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days](https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html)
2. [Google Awarded a $250,000 Bounty for a Full-chain Chrome Exploit Found Using GPT-5.6](https://cybersecuritynews.com/google-chrome-exploit-gpt-5-6/)
3. [XBOW Rewarded for Exploit Affecting a Billion Users](https://xbow.com/news/xbow-rewarded-for-exploit-affecting-a-billion-users)
4. [XBOW used GPT-5.6 Sol to build a $250,000 Chrome exploit in six days](https://thenextweb.com/news/xbow-chrome-exploit-gpt-5-6-sol-250000-six-days)
5. [In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit](https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/)
6. [XBOW uses OpenAI's GPT-5.6 to exploit Chrome, earns $250,000 bounty](https://cryptobriefing.com/xbow-gpt-5-6-chrome-exploit-bounty/)
7. [CVE-2026-85045 Vulnerability Details](https://app.opencve.io/cve/CVE-2026-85045)
8. [Daily Cybersecurity News, October 14, 2026](https://cyberrecaps.com/news/cybersecurity-news-october-14-2026)
9. [Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)](https://threatprotect.qualys.com/2026/09/06/google-chrome-zero-day-vulnerability-exploited-in-the-wild-cve-2026-85046/)
10. [Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day](https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html)
11. [Inside XBOW's 6-day Chrome full chain, and the 3 patches to check this week](https://dev.to/kyo_rush/inside-xbows-6-day-chrome-full-chain-and-the-3-patches-to-check-this-week-4m5j)