On Tuesday, October 13, the security firm XBOW published a write-up that puts a hard number on how fast AI can help build a browser exploit. According to XBOW, its AI agents helped chain three previously unknown Chrome bugs into one full exploit that could run code on a Windows PC after a user only loaded a malicious web page. Google has fixed all three bugs and paid XBOW a $250,000 bounty.
XBOW, which calls itself an autonomous offensive security company, laid out its account in its announcement and a longer technical write-up. The Hacker News and other outlets kept covering the story through October 17. Most of the technical detail still comes from XBOW, so treat it as the company's account until independent researchers confirm it.
How the XBOW Chrome exploit chained three bugs
Chrome runs web content inside layered sandboxes, which are walls meant to keep a compromised tab away from the rest of the computer. A full chain is a set of bugs that each defeat a different layer. When every layer falls, the browser's containment fails and the attacker reaches the operating system. The Next Web describes the XBOW chain the same way.
XBOW says the three bugs sat in three different components. The first was in V8, Chrome's JavaScript engine, and gave the attacker control of memory inside the engine's sandbox. The second was in an animated WebP image decoder and escaped that sandbox. The third was in Crashpad, Chrome's crash handler, and turned that foothold into full code execution.
The most alarming part is how little the victim had to do. Per XBOW, a malicious page loaded in an ordinary tab could lead to code running outside Chrome's sandbox on Windows. No click and no download were required. That separates this chain from attacks that depend on a phishing lure, because the page itself is the trigger.
How AI agents built the exploit in six days
XBOW says it built the chain between August 2 and August 7, while members of its team were at Black Hat and DEF CON in Las Vegas. The agents ran OpenAI's publicly available GPT-5.6 Sol model. They searched Chrome's source code, tested ideas, built proofs of concept and drafted the exploit itself.
People stayed in the loop. According to XBOW, humans chose the targets, supplied context, checked the results and decided how to join the pieces together. That division of labor is the real story here. The model handled the slow, repetitive search and iteration, while experienced researchers made the judgment calls that turned fragments into a working chain.
The process was not a straight line. An earlier XBOW attempt spent about two months before it collided with a bug Google already knew about, so the team swapped in a different chain. Two months of effort that ends in a dead end is a reminder that AI assistance does not remove dead ends. It shortens how long each one takes to find.
Key dates from the reporting:
- August 2 to August 7: XBOW builds the chain.
- August 25: Chrome 152.0.7977.65 ships fixes for the bugs.
- September 3: Chrome 152.0.7977.82 ships fixes for the bugs.
- October 13: XBOW publishes its write-up and announces the bounty.
Which Chrome versions fix the three bugs
The fix versions come from secondary reporting that cites Google's release notes, not from Google's notes read directly. Confirm them against Google's own release notes before you rely on them in a compliance report.
Two CVE records are in circulation. CVE-2026-85045 is a V8 race condition fixed in builds before 152.0.7977.82. The CVE record rates it high severity with a CVSS score of 7.5. CVE-2026-78952, a Crashpad out-of-bounds write, carries a CVSS score of 8.3 in one daily cybersecurity roundup.
The mapping between those IDs and XBOW's three stages is disputed. XBOW's announcement assigns CVE-2026-85045 to the WebP stage. The Hacker News and a DEV Community write-up assign it to the V8 bug and say the WebP bug has no public identifier. Until that is resolved, anyone citing CVE numbers for this chain should say the mapping is still in question.
This chain is separate from a Chrome zero-day Google patched in September. Qualys ThreatPROTECT reported that CVE-2026-85046 was exploited in the wild, and the Chrome 152 update that month addressed 12 vulnerabilities. That September bug was already being used against people, which is a different situation from the XBOW work.
What the $250,000 bounty and $40,000 cost really mean
Crypto Briefing reports that $250,000 is Google's maximum full-chain bounty, and that this was the first such award in 2026 and only the second in the program's history. Google introduced new full-chain bounty rules in April 2026, and XBOW says its award was the first under those rules.
The compute cost is the number that should catch a security manager's attention. XBOW estimates the work cost about $40,000 in compute. It also says the bugs could affect roughly 1 billion Chrome users, with its demo targeting Windows. Both figures come from XBOW itself, and neither has independent verification yet.
Even if the cost estimate is off by a wide margin, the gap between roughly $40,000 in compute and a $250,000 payout shows where the economics point. Attackers and well-funded research teams can use the same kinds of models. Bounty programs now have to judge how to handle AI-assisted submissions that arrive quickly.
Patch-timing assumptions that depend on attackers needing months to build a chain deserve a second look. The bounty program gains better-prepared submissions, but defenders lose the slack they used to count on between a fix and a working exploit.
The policy debate is part of the picture. The Next Web reports that OpenAI released GPT-5.6 to the public in July and paused a model in August over cyber risk. One commentary cited in that report argues that restricting powerful models misses the point, because XBOW used a model that is already public. That argument deserves a hearing. The model XBOW used was already in public hands, so the question is less about access and more about how defenders respond.
The immediate risk is patch lag, not active attacks. SecurityWeek reports that Google reproduced the bugs, fixed all three and, according to XBOW, found no sign they were used against Chrome users.
How to check your Chrome version on Windows
Chrome updates itself, but a fix takes effect only after the browser restarts. Follow these steps on a Windows PC:
- Open Chrome and select the menu in the top-right corner.
- Choose Help, then About Google Chrome.
- Confirm the version is 152.0.7977.82 or later.
- If an update is waiting, relaunch the browser so the fix takes effect.
For IT teams, the steps scale up. Confirm Chrome is updated on every managed Windows endpoint, check the version reported in your device inventory, and review any update policy that holds back browser releases. Teams that also run perimeter devices should review our coverage of the Palo Alto PAN-OS zero-day and the Windows shell zero-day that Microsoft patched. Both are reminders that patch timing matters across the whole stack.
What to watch next
XBOW has not said whether it will publish the full exploit or deeper technical details, and the sources do not settle the question. Google has not said in these sources whether its approach to AI-assisted bounty submissions will change. Those are the two signals that matter most.
A published exploit would let other researchers verify the chain and test their own detections. A rule change from Google would show how a major bounty program plans to handle work that a model can produce in days. Watch the CVE mapping too, because a corrected record will tell defenders which fix covers which stage.
