AI-assisted Chrome exploit earned XBOW $250,000 in six days

Feeds.4Sysops •IT News • October 14, 2026

XBOW used OpenAI’s public GPT-5.6 Sol model with human researchers to build a Chrome full-chain exploit for Windows in six days, earning Google’s $250,000 bounty. The chain combined three previously unknown bugs to run code outside Chrome’s sandboxes when a user loaded a web page. All three flaws have been fixed, and XBOW says the exploit was not used against Chrome users. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Exploit Chain Earns $250K Chrome Bounty XBOW researchers developed a Chrome exploit chain in just six days, leveraging three vulnerabilities to execute code on Windows machines simply by loading a webpage. The vulnerabilities, confirmed by Google, were fixed in Chrome versions 152.0.7977.65 and 152.0.7977.82. The exploit utilized flaws in the V8 JavaScript engine, the animated WebP decoder, and Crashpad, Chrome's crash-reporting component. The project, which cost approximately $40,000 in AI compute resources, marks a significant acceleration in exploit development, previously taking months to achieve similar results. Google awarded XBOW a $250,000 bounty under its Vulnerability Reward Program for this achievement. The vulnerabilities were never against users. Users are advised to update their Chrome browsers to the latest versions to mitigate risks. 12 sources 33

Extracted Entities

AI-assisted Chrome exploit earned XBOW $250,000 in six days

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (1)