Security researchers spent 6 days doing their Chromework, built 1B user exploit

Researchers at security startup Xbow spent six days developing a full-chain exploit for Chrome by chaining three zero-day vulnerabilities. Using OpenAI's GPT-5.6-Sol model, the Xbow team, consisting of Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers, successfully built an exploit capable of executing code outside of the browser's sandbox on Windows machines.

Google subsequently fixed these vulnerabilities and paid the Xbow team a $250,000 bounty, its highest reward for a Chrome full-chain exploit. The attack series exploited a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. While Google patched all three issues, users must update to Chrome version 152.0.7977.82 or later to ensure protection against this exploit.