Artificial intelligence created an attack for Chrome in six days
Researchers at security firm XBOW used an AI model to build a full-chain Google Chrome exploit combining three unknown bugs in six days. The agentic workflow handled source code analysis, proof-of-concept testing, and initial drafts. Google confirmed the vulnerabilities, released patches, and paid a $250,000 reward. Security firm XBOW announced that its researchers used a publicly available…
Researchers at security firm XBOW utilized an artificial intelligence (AI) model to develop a comprehensive Google Chrome exploit within six days, by combining three previously unknown vulnerabilities. The AI model managed tasks such as source code analysis, proof-of-concept testing, and the initial creation of the exploit. Upon discovery, Google acknowledged the vulnerabilities and promptly released patches, while XBOW awarded itself the maximum $250,000 reward for successfully exploiting the entire attack chain.
The attack, completed between August 2 and 7, 2026, requires no user interaction beyond visiting a compromised webpage, thus facilitating code execution on Windows systems without any prior clicks or downloads. Crucially, Google confirmed that the exploit had not been previously deployed on actual users prior to its resolution.
The AI-assisted methodology involved a six-day period of preparation and testing, costing approximately $40,000. XBOW's researchers directed the AI in searching the browser code, evaluating ideas, crafting prototypes, and drafting the exploit's initial segments. The AI focused on three distinct Chrome components: an execution engine, image reading system, and error handling mechanism.
The vulnerabilities impacted a billion Windows users before Google patched versions 152.0.7977.65 (on August 25), 152.0.7977.82 (on September 3), and the broader 152 update series.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
