Six Days, About $40,000 in AI Charges, One $250,000 Bounty: The Timeline of an AI-Assisted Chrome Break-In
Security firm XBOW used AI agents running a public OpenAI model to chain three Chrome bugs into an attack that ran code on Windows from a single web page. Google fixed the bugs and paid its top reward. Here is how it unfolded, and why the speed matters.
The most valuable bug report Google pays for is a “full chain”: a set of Chrome flaws that, used together, take an attacker from a web page all the way to running code on the computer underneath. This year, a security company produced one with heavy help from AI agents, and the speed is the part getting attention. Here is the sequence of events.
This timeline is drawn from The Hacker News’ account of XBOW’s announcement and write-up, with team and technical details from The Register.
January 2026: the challenge is set
XBOW, a company that builds AI-driven security testing, set the goal of a full Chrome exploit at a staff meeting in Malta. Its first complete Chrome chain took about two months to build.
August 2 to August 7: the six-day sprint
During the Black Hat and DEF CON conferences in Las Vegas, an XBOW team built the chain that would win the award. AI agents running OpenAI’s publicly available GPT-5.6 Sol model searched Chrome’s source code, tested ideas, built proofs of concept and wrote first drafts of each exploit stage. The researchers, who The Register names as Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers, chose targets, supplied context, challenged the agents’ results and decided which pieces to combine. By XBOW’s own count, the run cost about $40,000 in AI charges.
A near miss along the way
One version of the chain almost fell apart when a bug it depended on turned out to be one Google already knew about. Because the exploit had been built in swappable parts with backups ready, the team replaced that piece and kept going.
What the finished chain did
- A bug in Maglev, part of Chrome’s V8 JavaScript engine, gave the attacker control over memory inside the engine.
- A bug in the code that decodes animated WebP images broke out of V8’s inner sandbox.
- An overflow in Crashpad, Chrome’s crash handler, crossed the outer process sandbox and delivered code execution on the Windows machine itself.
The user only had to load a web page. No click or download was needed.
August 25 and September 3: the fixes ship
Google confirmed and fixed all three bugs. The two with public identifiers were fixed in Chrome 152.0.7977.65 on August 25 and 152.0.7977.82 on September 3. The Hacker News notes that the identifier XBOW’s announcement gives for the WebP stage is the same one Google assigns to the V8 bug, so no separate public identifier could be confirmed for the WebP fix.
October 13: the announcement and the reward
XBOW announced that Google had paid it $250,000, the most Chrome’s reward program offers for a single report, under rules Google updated in 2026 and which allow at most four such awards a year. XBOW calls it the first full-chain reward under those rules. The company says the bugs were never used against Chrome users and estimates that, before the fixes, about 1 billion people running Chrome on Windows were exposed to this kind of attack.
“Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days,” Dolan-Gavitt wrote. His message to defenders was short: “Defend accordingly.”
What this means for your company
This chain was reported responsibly and fixed, so there is no emergency here. The trend is the story: if a well-funded team can now build a top-tier browser exploit in under a week, attackers can shorten their timelines too. For a small or mid-size business, that argues for a few habits:
- Make browser restarts routine. Chrome downloads updates on its own, but the fix only applies after a relaunch. Check that your browsers are on 152.0.7977.82 or later, and use your management tools to enforce restarts.
- Shorten the gap between patch and install. The window between a fix being released and attackers using the flaw is shrinking. Monthly patching is a floor, not a target, for browsers and internet-facing systems.
- Plan for the browser to be breached. Standard user accounts, endpoint protection that watches for unusual behavior, and limited access to sensitive data reduce the damage if a malicious page ever gets through.
Need help keeping browsers and endpoints patched as fast as the threats are moving? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
