Security researchers at startup Xbow chained three zero-day vulnerabilities in Chrome into a working exploit capable of running code outside the browser's sandbox on Windows computers, the team disclosed Tuesday. The team used OpenAI's GPT-5.6 Sol model to help identify the flaws and build the attack chain, which Xbow estimates could have affected roughly one billion users globally. Google patched all three vulnerabilities and awarded Xbow a $250,000 bounty, its highest payout for a full-chain Chrome exploit.
The four-person team — Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers — completed the work in just six days during the Black Hat and DEF CON conferences, spending approximately $40,000 in token charges for the AI model. The attack crossed two security boundaries in three stages: a V8 compiler bug in Maglev that granted read and write access throughout V8's pointer-compression cage, an animated-WebP decoder flaw that escaped the V8 sandbox, and a memory-safety overflow in Crashpad that crossed the outer process boundary to achieve unsandboxed code execution on the host machine. Google has released fixes in Chrome version 152.0.7977.82 or later, though the patches only take effect once users restart their browser.
"The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive," Xbow CEO Oege de Moor stated. De Moor said a three-letter intelligence agency veteran told him his team used to spend six months trying to identify this type of vulnerability and gain total access. In a technical writeup, Dolan-Gavitt explained that AI agents searched source code, tested hypotheses, and developed proofs of concept and exploit stages, while the human researchers selected targets, provided context, challenged the agents' outputs, and decided which attack components to link together. The researchers applied "a fair bit of our own human expertise and judgment," he wrote.
The exploit targeted Chrome's layered security architecture, which uses nested sandboxes to contain compromised code and prevent attackers who hack an individual website from taking over the entire computer. The V8 sandbox prevents memory corruption flaws in the V8 JavaScript engine from affecting other memory, and it sits inside the operating-system process sandbox. This nested design means escaping V8's memory restrictions doesn't automatically provide native code execution, and even achieving native code execution inside Chrome's renderer doesn't bypass the outer process sandbox that restricts access to the rest of the machine. The second vulnerability exploited a property that the V8 sandbox deliberately doesn't enforce but that Blink incorrectly assumed it could trust, rather than attacking the sandbox itself.
The time and resources required to achieve a full-chain Chrome exploit show that "the bar is significantly lower" for attackers armed with large language models, Dolan-Gavitt wrote, advising organizations to "defend accordingly." The $250,000 bounty represents a strong return on the $40,000 investment in AI tokens, proving that publicly available models can now assist in discovering vulnerabilities that previously required months of work by specialized intelligence teams. Organizations relying on browser security as a defensive layer may need to reassess their assumptions about how quickly sophisticated exploits can be developed when skilled researchers combine human judgment with machine automation to probe complex software at scale.