Security startup Xbow has disclosed how its researchers, assisted by OpenAI’s GPT-5.6 Sol model, chained three Chrome zero day vulnerabilities into an exploit that escapes the browser sandbox and runs code on Windows machines. Google patched all three flaws and paid a $250,000 bounty, its top reward for a Chrome full chain exploit. Xbow estimates the chain could have affected about one billion users.
The chain crossed both of Chrome’s security boundaries in three stages: a bug in the V8 JavaScript engine’s Maglev compiler, an animated WebP decoder flaw used to escape the V8 sandbox, and a memory safety overflow in Crashpad to cross the outer process sandbox. The division of labour is the finding. AI agents searched source code, tested hypotheses and built proof of concept stages, while the human researchers chose targets, supplied context and decided which components to chain.
The cost accounting is what will travel. The team of four spent six days during the Black Hat and DEF CON conferences and about $40,000 in model tokens. Its chief executive said an intelligence agency veteran told him comparable work used to take his team six months.
All three vulnerabilities are fixed, though Chrome fixes only take effect when users relaunch the browser, with version 152.0.7977.82 or later carrying the patches. The defensive implication is uncomfortable and general: if model assisted research cuts the cost of full chain exploits by an order of magnitude, the binding constraint becomes how fast vendors can ship and users can apply fixes, not how fast flaws can be found.