XBOW chains three Chrome zero-days with GPT-5.6 Sol and wins Google’s $250,000 bounty

What did XBOW announce?

XBOW, a company that builds autonomous offensive-security tooling, said on 13 October 2026 that it had discovered and built a full-chain Chrome exploit affecting an estimated one billion Windows users. A full chain is a set of separate bugs that, used together, take an attacker all the way from an ordinary web page to running code on the computer. Chrome is built in layers precisely so that a single bug does not get that far.

The exploit earned a $250,000 reward from Google’s Chrome Vulnerability Reward Program. According to XBOW’s announcement carried by AFP, it was the first full-chain Chrome award under Google’s 2026 VRP rules, introduced in April, and the first granted to an autonomous offensive-security platform. XBOW reported every bug through Google’s official programme; Google reproduced the exploit, confirmed it and shipped fixes, and the company says the flaws were never used against real users.

The headline is not really the money. It is the speed. Oege de Moor, XBOW’s founder and chief executive, said a chain that “previously would have taken months” took one researcher six days and about $40,000 of compute. A three-letter intelligence veteran told the team his people used to spend six months on this kind of total-access vulnerability. XBOW’s own first pre-model attempt at a Chrome chain took two months; the awarded one took six days.

What were the three bugs?

The chain crossed two sandbox boundaries in three stages, laid out in a technical companion post by XBOW researcher Brendan Dolan-Gavitt. Chrome keeps JavaScript-engine corruption inside an in-process V8 “cage”, and keeps the whole renderer inside an operating-system process sandbox, so even native code execution in the renderer cannot freely touch the machine.

Stage one was a bug in Maglev, V8’s mid-tier optimising compiler. During deoptimization it reused a single mutable HeapNumber across distinct JavaScript objects, violating a compiler invariant that such numbers are immutable. By making one object’s double field change the load offset used by optimized code, the exploit gained read and write access throughout V8’s four-gigabyte cage.

Stage two broke out of that cage through Chrome’s animated-WebP image decoder, tracked as CVE-2026-85045. Rather than attack the sandbox directly, XBOW exploited an assumption the sandbox deliberately does not enforce: that a transferred image buffer is immutable. Two valid WebP files sharing one backing store let the decoder combine one image’s cached geometry with another image’s current bytes, a time-of-check/time-of-use flaw that produced one precise write to native memory outside the cage.

Stage three used that write to reach Crashpad, Chrome’s crash handler, which runs outside the sandbox (CVE-2026-78952). Crashpad assumed a suspended renderer could not change its own memory, but a Windows thread flag let a renderer thread keep running across the freeze and flip page protections between a failed read and its retry. That tricked Crashpad into an oversized copy that overwrote a live writer object and, step by step, launched a program — in the proof of concept, Calculator — outside the sandbox from nothing more than loading a page.

How did the AI agents and the researchers split the work?

XBOW is clear that this was a partnership between people and machines, not an autonomous hack. The team deliberately picked GPT-5.6 Sol, a model available to anyone, rather than a specialised security model or one with restricted access. The agents searched Chrome’s open-source code, tested hypotheses, built proofs of concept and wrote the earliest exploit drafts; the researchers set strategy, chose where to look, challenged the agents’ work and decided which components to join.

Rather than ask one agent to produce an exploit end to end, XBOW split the work into parallel campaigns with narrow goals: broad vulnerability search, V8 memory corruption, a V8 sandbox escape, a renderer sandbox escape and integration. Each stage got a clean interface and a backup route, so a component could be swapped without rebuilding the rest.

That modularity proved essential. The team’s first finished chain used a different V8 sandbox escape that turned out to duplicate a bug Google had already found internally — exactly the kind of collision that disqualifies a bounty report. During Black Hat and DEF CON week in Las Vegas, between Sunday 2 August and Friday 7 August, Dolan-Gavitt and the agents swapped in the animated-WebP escape and rebuilt the chain. The researchers also fed the agents high-quality examples, including an “island-hopping” loader technique from XBOW’s own earlier work, to make the exploit reliable.

Why six days and $40,000 matter

Reconstructed from archived Codex logs, the six-day campaign cost roughly $40,000 in API charges — about one-sixth of the bounty. The Forbes Wiretap report puts the same figure at the centre of the story, framing it as the cost to find a Chrome zero-day with an off-the-shelf model.

The number matters because it collapses an economic barrier. Chrome is one of the most hardened pieces of software on earth, poked at by the world’s best hackers for years, and a full chain was a months-long project for a skilled team. The combination of a public model and expert judgment did it in under a week. XBOW itself cautions against overreading this: it still applied a lot of human expertise, so six days and $40,000 is not a recipe anyone can follow blindly. But it argues the bar has dropped sharply, echoing the same cost-of-offense shift behind our coverage of more than 400 scientists urging labs to airgap cyber-capable models.

It also fits a run of results where general-purpose models, not dedicated security products, do the finding. GPT-5.6 Sol is the same family OpenAI positions for serious engineering work; we looked at the economics of that tier in our write-up of GPT-6.1 Sol’s lower-cost push into serious work. Security startups are racing to package the capability, as with Chainguard’s Harness, a Claude Mythos vulnerability hunter.

What this means for defenders

Both XBOW and OpenAI frame the result as a defender’s story. XBOW argues defenders have an advantage attackers never will: they can test their own code first. Clint Gibler, OpenAI’s head of cyber research, said the company wants to put these capabilities in more defenders’ hands to protect widely used software, and noted that a single XBOW researcher used its models to uncover a chain Google has now fixed.

The practical advice from XBOW is short. First, keep Chrome current: all three bugs are fixed, Chrome updates itself, but a fix only takes effect after you relaunch, so restart when the update button appears. Second, assume your own applications are exploitable and test them before someone else does, because the cost of finding bugs is falling for both sides. XBOW says it is now building an autonomous product for testing compiled software — desktop apps, servers and embedded devices — beyond the web applications it started with.

The uncomfortable part is that de Moor expects each of the three bugs could be found by agents working alone within a year. That lands in the same debate as the UK’s decision to pour money into agentic safety, including NVIDIA’s $250 million UK compute pledge for agent-security research, and the broader argument over whether powerful models should be restricted at all. XBOW’s answer is that the model it used is already public, so restriction is the wrong question.

What the result does not show

A few caveats are worth stating plainly, some of them XBOW’s own:

• This was not autonomous. XBOW stresses that human researchers chose targets, supplied context, challenged results and made the key decision to build the chain in swappable parts; the model did the volume of search and drafting.
• The exploit was built in August and disclosed through Google’s programme; the public announcement and technical write-up came on 13 October, after the bugs were fixed. The dates of discovery, award and publication are different.
• Reproducibility is unproven. XBOW says six days and $40,000 is not a formula anyone can repeat without comparable expertise, and bug collisions already killed one of its chains.
• The $250,000 figure is Google’s bounty, and the $40,000 is XBOW’s reconstruction of its own API spend from Codex logs, not an audited cost.
• This is a vendor announcement about the vendor’s own result. Google confirmed and fixed the bugs, but the capability claims and economics come from XBOW and OpenAI.