XBOW Used OpenAI's Public GPT-5.6 Sol Model to Build Chrome Exploit in Six Days

Security firm XBOW says a single researcher used AI agents running OpenAI's publicly available GPT-5.6 Sol model to build a full-chain Google Chrome exploit in six days. The attack chains three then-unknown bugs to run code on a Windows computer when the user only loads a web page, with no click or download required.

Google confirmed all three bugs, fixed them, and paid XBOW its maximum $250,000 reward for a full Chrome exploit, the first full-chain reward under Google's 2026 rules and the first to an autonomous security company.

How the exploit works

Chrome runs web page code inside two nested sandboxes, and the chain crossed both. The first bug, in V8, Chrome's JavaScript engine, gave the attacker control of memory inside the engine. The second, in the animated WebP image decoder, used that control to escape the inner sandbox and make one precise write to computer memory. The third, in Crashpad, Chrome's crash handler which runs outside the sandbox, turned that single write into full code execution on the machine.

Two of the bugs carry public identifiers. CVE-2026-85045, the V8 bug, was fixed in Chrome 152.0.7977.82 on September 3. CVE-2026-78952, the Crashpad bug, was fixed in Chrome 152.0.7977.65 on August 25. The WebP bug was fixed in the same Chrome 152 cycle, but no public identifier can be confirmed for it: the identifier XBOW's announcement lists for the WebP stage is the one Google and XBOW's technical write-up both assign to the V8 bug.

Six days and $40,000

XBOW built the awarded chain between Sunday, August 2 and Friday, August 7, during the Black Hat and DEF CON conferences in Las Vegas. The sprint followed months of preparation: the company set the challenge at a January staff meeting in Malta, and its first full Chrome chain took two months. One version nearly failed when a bug it relied on turned out to be one Google already knew about, but XBOW had built the exploit in swappable parts with backups ready.

By the company's count of its usage logs, the six-day run cost about $40,000 in AI charges. The AI agents searched Chrome's source code, tested ideas, built proofs of concept and wrote first drafts. The researchers chose the targets, supplied context, challenged the agents' results and decided which pieces to join.

"Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days," said Brendan Dolan-Gavitt, the XBOW researcher who built the chain with the agents. Founder Oege de Moor said: "It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months."

Patches and a warning

Chrome updates on its own, but the fix only takes effect after the browser restarts. XBOW advises users to relaunch Chrome and confirm the version is 152.0.7977.82 or later. The company says the bugs were never used against Chrome users and that, before the fixes shipped, an estimated 1 billion people running Chrome on Windows were exposed to this kind of attack.

Google's Chrome Vulnerability Reward Program pays up to $250,000 for a full-chain exploit, the most it offers for a single report, under rules it updated in 2026, and awards at most four per year. Dolan-Gavitt's message to defenders was blunt: "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!" He added that the bar is now much lower, and ended with two words: "Defend accordingly."

Sources: The Hacker News