{
  "id": 14536129,
  "title": "Security researchers spent 6 days doing their Chromework, built 1B user exploit",
  "url": "https://urgent.news/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-14536129",
  "topic": "science",
  "section": "Science",
  "published": "2026-10-14T19:12:33.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134"
  },
  "original_language": "en",
  "account": "Researchers at security startup Xbow spent six days developing a full-chain exploit for Chrome by chaining three zero-day vulnerabilities. Using OpenAI's GPT-5.6-Sol model, the Xbow team, consisting of Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers, successfully built an exploit capable of executing code outside of the browser's sandbox on Windows machines. Google subsequently fixed these vulnerabilities and paid the Xbow team a $250,000 bounty, its highest reward for a Chrome full-chain exploit. The attack series exploited a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. While Google patched all three issues, users must update to Chrome version 152.0.7977.82 or later to ensure protection against this exploit.",
  "summary": "Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Security researchers spent 6 days doing their Chromework, built 1B user exploit",
        "url": "https://urgent.news/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b",
        "published": "2026-10-14T19:12:33.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}