GoKawiilXBOW built a $250,000 Chrome full-chain exploit in six days using AI agents
XBOW developed a Chrome full-chain exploit combining a V8 compiler bug, an animated-WebP decoder bug, and a Crashpad memory-safety flaw, enabling code execution outside the renderer sandbox from a single web page. Google awarded it the first $250,000 payout under Chrome's new full-chain VRP rules introduced in April 2026. The chain was produced in six days by AI agents running OpenAI's gpt-5.6-sol model, guided by human researchers, at an estimated API cost of $40,000.
GoKawiil's interpretation of the reporting above, not reported fact.
XBOW says such a chain would have taken a four-person team six to nine months before LLMs, suggesting AI-assisted vulnerability research could sharply compress the timeline for finding high-value exploits. This could pressure browser vendors to accelerate patching and bug-bounty triage as offensive capability scales with AI tooling, though the broader implications for defensive security practices remain to be seen.
- Exploit chained a V8 bug, a WebP decoder bug, and a Crashpad memory-safety flaw to escape Chrome's sandbox.
- Google paid $250,000, the first award under its full-chain VRP rules from April 2026.
- AI agents built the six-day exploit chain for about $40,000 in API costs, down from months of manual work.
Source: xbow.com, 2026-10-13
Published there as: “Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.