Researchers at security startup Xbow used OpenAI’s GPT-5.6 Sol model to help combine three Chrome zero-day vulnerabilities into an exploit capable of running code outside the browser’s sandbox on Windows. Xbow estimates that about one billion users worldwide could have been affected.
Google patched all three flaws and paid Xbow $250,000, its highest bounty for a full Chrome exploit chain. Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers found the flaws and built the chain in six days during the Black Hat and DEF CON conferences. The team spent about $40,000 on model tokens.
Xbow CEO and founder Oege de Moor compared that timetable with an account from an intelligence-agency veteran whose team, he said, once spent six months seeking a similar level of access. “We did it in six days,” de Moor said.
Read nextMIT researchers improve weather forecasts two to six weeks aheadThe exploit crossed two sandbox boundaries
Chrome uses sandboxes to limit what compromised code can reach. Its V8 sandbox restricts memory access inside the JavaScript engine. An outer process sandbox limits access to the rest of the machine, even if an attacker runs native code in a Chrome renderer.
The first flaw was in Maglev, V8’s mid-tier optimizing compiler. A reused, mutable boxed number during deoptimization gave the exploit read and write access across V8’s pointer-compression cage. An animated-WebP decoder bug then let it escape the V8 sandbox. Dolan-Gavitt said that stage exploited a property the V8 sandbox does not enforce but that Blink incorrectly trusted.
Finally, an overflow in Crashpad crossed the outer process boundary, allowing unsandboxed code execution on the Windows host.
Researchers directed the AI agents
In a technical account, Dolan-Gavitt said agents searched source code, tested hypotheses, and developed proofs of concept and exploit stages. The researchers selected targets, supplied context, challenged the agents’ results, and chose which components to combine. “We did apply a fair bit of our own human expertise and judgment,” he wrote. He said the time and cost of the work show that “the bar is significantly lower” for attackers using large language models.
Chrome installs updates automatically, but a fix takes effect only after the browser is relaunched. Chrome users should relaunch it and check that they are running version 152.0.7977.82 or later.
