Xbow spent $40K on AI and cracked Google Chrome wide open
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it. Researchers at Xbow USA worked for six days on developing the exploit , which earned them a $250,000 bug bounty from Google, the first under the new 2026 rules . They chose OpenAI’s GPT-5.6…
Researchers at Xbow USA discovered a chain of vulnerabilities in Google's Chrome browser that could have allowed them to take control of one billion Windows machines worldwide. The exploit was developed using just $40,000 worth of AI compute time on OpenAI's GPT-5.6 Sol, the first bug bounty under the new 2026 rules. The researchers used the AI model to search Chrome's source code, test ideas, and build proofs of concept, while strategizing and checking the work.
They successfully chained a vulnerability to escape the V8 JavaScript engine sandbox and then Chrome's operating-system process sandbox, launching a malicious Windows app from within a web page. Xbow presented its findings to Google, which fixed the flaws. The researchers detailed the entire exploit development process in a blog.
Written by urgent.news from Computerworld's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
