Vulnerability / research

XBOW demonstrates an AI-assisted Chrome exploit chain

Reported

What happened

XBOW researchers and AI agents chained three Chrome flaws to demonstrate code execution outside the browser sandbox on Windows after a page loaded.

Parties and reporting

AI tools and systems: OpenAI GPT-5.6 Sol, XBOW research agents, Google Chrome, V8, WebP decoder, Crashpad

Outcome

XBOW says Google reproduced the chain, fixed the bugs and awarded $250,000. The researchers report no use of these vulnerabilities against Chrome users.

Operating lesson

Measure browser patching by the version actually running after restart; test interacting components because individually constrained bugs can form a stronger chain.

Evidence and limits

Authorized security research, not a malicious attack. October 13 dates the combined AI-assisted disclosure; the six-day August campaign built on earlier work and human expertise. Fix availability does not confirm every installation updated.

Sources