Xbow Used GPT-5.6 Sol to Build Chrome Full-Chain Exploit in Six Days, Earns $250K Bounty

Security startup Xbow says it used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Google Chrome into a full exploit capable of executing code outside the browser's sandbox on Windows machines. Xbow estimates the chain could affect about one billion users worldwide.

Google has fixed all three flaws and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit.

How the exploit crossed Chrome's nested sandboxes

Chrome relies on layered defenses, including the V8 sandbox that contains memory corruption flaws in the V8 JavaScript engine, nested inside an operating system process sandbox. Escaping the V8 sandbox alone does not grant native code execution on the host; the outer process sandbox still restricts access to the rest of the machine.

According to Xbow researcher Brendan Dolan-Gavitt, the attack chain crossed both boundaries in three stages. It combines a V8 compiler bug in Maglev, V8's mid-tier optimizing compiler, caused by a reused, mutable boxed number during deoptimization, which gives read and write access throughout V8's pointer-compression cage. The second stage, an animated-WebP decoder bug, served as the V8 sandbox escape by exploiting a property the sandbox deliberately does not enforce and that Blink incorrectly assumed it could trust. Finally, an overflow in Crashpad was used to cross the final outer process boundary and achieve unsandboxed code execution on the host.

Humans directed, AI agents executed

AI agents running GPT-5.6-Sol searched source code, tested the team's hypotheses, and developed proofs of concept and exploit stages. The human researchers, Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers, chose the targets, provided context, challenged the agents' results, and decided which attack components to chain. "We did apply a fair bit of our own human expertise and judgment," Dolan-Gavitt wrote.

The team spent just six days, during the Black Hat and DEF CON conferences, and about $40,000 in token charges to discover the vulnerabilities and build the attack chain. Xbow CEO and founder Oege de Moor noted that a former three-letter intelligence agency veteran told him his team used to spend six months trying to identify this kind of vulnerability and get total access.

What it means for defenders

While Google patched all three issues and Chrome installs updates on its own, a fix only takes effect once the user relaunches the browser. Users are advised to run Chrome version 152.0.7977.82 or later.

Dolan-Gavitt said the time and money spent illustrate yet again that the bar is significantly lower for attackers armed with LLMs. His advice: defend accordingly.

Sources: The Register