Google awarded XBOW $250,000 after researchers combined three Chrome vulnerabilities into an AI-assisted exploit chain enabling code execution outside the browser’s renderer sandbox on Windows.
XBOW says the team spent six days developing the chain and incurred about $40,000 in model API charges. The vulnerabilities are now fixed.
The company estimates the exposure affected a billion users globally, although that figure should not be confused with confirmed compromises.
Google Pays $250,000 for AI-Assisted Chrome Exploit
The disclosed demonstration launched Windows Calculator from a webpage in signed Chrome Beta, establishing execution beyond the browser’s containment boundary rather than documenting malicious exploitation.
The chain began in Maglev, V8’s optimizing compiler. During deoptimization, the engine incorrectly reused a mutable HeapNumber across reconstructed JavaScript objects.
This violated an immutability assumption, letting optimized array accesses bypass their intended bounds and ultimately grant memory access across V8’s four-gigabyte pointer-compression cage.
The second vulnerability targeted animated WebP decoding through WebCodecs. After gaining memory control inside V8, the researchers retained access to image bytes that Blink thought it had exclusively transferred to ImageDecoder.
Changing those bytes caused the decoder to combine cached frame geometry with different image content. That time-of-check/time-of-use mismatch produced a native heap overflow outside V8’s cage.
The researchers converted the corruption into a chosen native memory write, then used a WebAssembly handoff to execute their next payload inside the renderer process. Escaping V8 alone did not remove Chrome’s operating-system sandbox.
The final stage exploited Crashpad, Chrome’s unsandboxed crash handler. Its memory-reading logic assumed a suspended renderer could not change memory protections.
However, a Windows thread configured to bypass process freezing continued running and changed page accessibility between a failed read and its retry.
Crashpad consequently copied more bytes than originally requested, overflowing a heap buffer. The exploit redirected existing handler functionality to launch Calculator while accommodating control-flow and shadow-stack protections on tested systems.
The fix limits retry reads to the original requested size and adds defensive validation. Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers worked with OpenAI’s GPT-5.6 Sol and predecessor models.
Agents searched source code, tested hypotheses, produced proofs of concept, and developed exploit components; researchers selected targets, validated findings, and directed integration.
The awarded effort ran from August 2 through August 7, following earlier research. Its modular design proved important when a sandbox-escape component duplicated an existing report: the team substituted the WebP vulnerability instead of rebuilding the entire chain.
The findings illustrate accelerated vulnerability research, not autonomous discovery without expertise. XBOW explicitly cautions that six days and $40,000 do not guarantee comparable results for any operator.
Its technical disclosure identifies fixes for all three stages, underscoring the importance of deploying patched browser builds promptly across managed Windows environments and personal devices alike.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
