Safety#Security scan#Reverse engineering
XBOW chains three Chrome bugs in six days with GPT-5.6 for Google's first $250k full-chain reward
XBOW's agents chained three Chrome bugs into a sandbox escape in six days, winning Google's first $250k full-chain bounty under its 2026 VRP rules.
XBOW, an autonomous offensive-security platform, published a teardown on October 13, 2026 with a set of numbers you can check: between August 2 and August 7, its agents — running OpenAI’s gpt-5.6-sol model — turned three previously unknown Chrome bugs into a complete exploit chain that starts with loading a web page and ends with the Windows Calculator running outside every sandbox. The chain earned the $250,000 top payout under Google’s Chrome Vulnerability Reward Program rules introduced in April 2026, the first full-chain award since those rules took effect. XBOW puts the API bill for the whole campaign at roughly $40,000. Per AFP, Google has fixed all three bugs; before the fixes, the bug class exposed an estimated one billion Chrome users on Windows.
Key points
- The attack work ran August 2–7 and was published only on October 13. Google reproduced, confirmed and patched all three bugs, and the exploits were never used against real Chrome users.
- The chain has three stages: a V8 Maglev deoptimization flaw for read/write inside the engine, an animated-WebP TOCTOU (CVE-2026-85045) to escape the V8 sandbox, and a Crashpad race (CVE-2026-78952) for code execution outside the renderer sandbox, ending in
cmd /k calc.exe. - The $250,000 award is the first full-chain payout under the April 2026 rules. The “about $40,000” figure is XBOW’s own estimate from archived Codex logs, not an audited number.
Background
Where the quarter-million comes from: Google’s April 2026 revision of the Chrome VRP set a $250,000 award for a complete exploit chain. XBOW’s blog calls this the first top-payout full-chain award since the new rules took effect; daily.dev’s analysis adds context — it is only the second $250k full-chain bounty in Chrome’s history, and both went to XBOW. The earlier submission took about two months of work; this one was compressed into six days. The starker comparison in the post is historical: before LLMs, a Chrome full chain of comparable complexity took a team of four roughly six to nine months.
The other side of bounty economics surfaced earlier this month: citing a flood of invalid automated reports, Google froze product-vulnerability submissions to its OSS bug bounty program on October 1 (see our earlier coverage). In the same October, AI is clogging one bounty inbox and collecting the top prize in another.
The facts
The official writeup assigns each stage its own Chromium issue:
| Stage | Component | Flaw | ID |
|---|---|---|---|
| In-engine read/write | V8 Maglev compiler | A mutable HeapNumber reused as a constant during deoptimization, yielding out-of-bounds read/write across the 4 GiB pointer-compression cage | Chromium issue 547819997 |
| V8 sandbox escape | Animated WebP decoder | A TOCTOU between cached frame geometry and bytes swapped through a transferred ArrayBuffer, buying one chosen 64-bit native write; CVE-2026-85045 | Chromium issue 548509153 |
| Outside the sandbox | Crashpad crash handler | A failed read of a “frozen” process still treated as stable page geometry, raced via a thread carrying the 0x42 flags; CVE-2026-78952 | Chromium issue 545820931 |
The CVE numbers come from the AFP wire; the issue numbers from XBOW’s post. The trigger is just loading a page — no clicks, no downloads — and the chain crosses two sandbox boundaries. The final step routes cmd /k calc.exe through the crash handler’s launcher into CreateProcessW.
The division of labor is equally explicit: XBOW’s researchers chose targets, supplied context, challenged results and decided which pieces to chain; the agents searched source code, tested hypotheses, built proofs of concept and developed the exploit stages. The work ran as parallel campaigns — broad bug search, V8 memory corruption, V8 sandbox escape, renderer escape, integration — each with clean interfaces and backup routes. The first sandbox escape collided with a bug Google already knew about (issue 542670566), so the team rebuilt that stage on the WebP path.
Pin down the cost claim: the ~$40,000 is XBOW’s own estimate based on archived Codex logs. No token count was published and no third party audited the figure. Per AFP, XBOW is directing the award money to fund security work for NGOs.
What others say
XBOW founder and CEO Oege de Moor told the wire: “Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path,” warning that attackers already operate at this speed and defenders need to match it. OpenAI’s head of cyber research, Clint Gibler, stayed on the defensive side: “We want to help more defenders find and fix critical vulnerabilities faster.”
The community didn’t take the writeup at face value. daily.dev’s analysis rounds up the objections: humans picked the targets and decided how the bugs were stitched, so how much autonomy is actually on display; whether the $40k covers failed attempts and dead ends or only the winning run; and whether the same budget still works against a browser that ships patches every six weeks rather than a static target. One skeptic argued a human could have found the chain for $4,000. Counterpoints exist at the budget end too: KeyGraph’s Shannon agent proved eight real vulnerabilities in a personal Kubernetes app in about three hours for roughly $2, including a stored-XSS chain that stole a session token — and one practitioner’s experience was that agents surface real issues in days, “but triage was the actual work.”
Defenders are shipping the same tooling: last week Anthropic rolled out free AI security scanning for open-source projects (see our coverage). There is also a July benchmark worth setting beside this — a separate event, not the same campaign: per GBHackers, Hacktron’s GPT-5.6 Sol Ultra reproduced a renderer full chain on known, already-patched Chrome bugs in three days, about 2.1 billion tokens and $1,596.89, using 747 sub-agents and ending in the macOS Calculator.
Our take
For anyone who writes or runs software, this story reprices the ledger: a “tolerable” low-severity bug now has to be valued as something an agent might automatically chain. The mismatch between a six-week patch cadence and a six-day attack budget used to be a theoretical risk; it now has a price tag.
Read the event precisely, though. This was not a model hacking Chrome on its own — humans chose the targets and the routes, the first chain hit a bug Google already knew, and the $40k is a self-estimate with unclear scope. What is confirmed is narrower but significant enough: against a mature, billion-user target, one person plus six days of agents delivered a chain worth the program’s top payout.
The open questions: whether the same budget works against a target that keeps patching, what Google’s own triage cost looks like, and how large the token bill really was. XBOW’s blog closes on one line: “Defend accordingly.”