Understand this story
Xbow USA researchers spent six days developing a Chrome exploit chain that first escapes the sandbox hosting the V8 JavaScript engine, then escapes Chrome's operating system process sandbox, and can launch Windows applications from within a malicious webpage; Google has already fixed the related flaws. They chose OpenAI's GPT-5.6 Sol to search the Chrome source code, validate ideas, and build a proof of concept, while strategy formulation, search direction, and verification of results remained the responsibility of the researchers. The AI compute cost $40,000, and they received a $250,000 Google bug bounty, the first under the new 2026 rules.
AI-generated from public reports
Latest development · Report
Xbow used $40,000 of AI compute to find a Chrome exploit chain, earning a $250,000 bounty from GoogleDevelopments
1 confirmed developments
Xbow uses AI to discover Chrome vulnerability chain and receives Google bounty
Source:Computerworld
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 16
Computerworld
Xbow used $40,000 of AI compute to find a Chrome exploit chain, earning a $250,000 bounty from Google
Researchers at Xbow USA spent six days developing a Chrome exploit chain that first escaped the sandbox hosting the V8 JavaScript engine, then escaped Chrome's operating system process sandbox, allowing a Windows application to be launched from within a malicious webpage; Google has fixed the relevant flaws. They chose OpenAI's GPT-5.6 Sol to search Chrome source code, validate ideas, and build a proof of concept, while strategy formulation, search direction, and result verification remained the responsibility of the researchers. The AI compute cost $40,000, and they received a $250,000 bug bounty from Google, the first under the new 2026 rules.