In a remarkable breakthrough, XBOW’s cybersecurity team has earned a $250,000 reward from Google. This comes after the team successfully identified a full-chain exploit in Chrome using AI technology. The discovery, made possible through the use of OpenAI’s GPT-5.6 Sol model, highlights the potential of AI in cybersecurity.
AI-Powered Discovery and Resolution
The XBOW team invested six days and approximately $40,000 in computing resources to uncover the vulnerabilities. Their findings, which Google has since addressed, were made public on October 13, 2026. The exploit involved a sequence of three distinct bugs, allowing a transition from JavaScript execution within a Chrome tab to code execution outside the browser’s security sandbox.
According to XBOW, the exploit could potentially impact around one billion users globally, with the demonstration specifically targeting Windows systems. Despite the severity of the vulnerabilities, there is no evidence that the exploit was used maliciously against any users.
Details of the Discovered Vulnerabilities
The first vulnerability was found in Chrome’s V8 JavaScript engine. A flaw in the Maglev compiler allowed separate JavaScript objects to share a variable during deoptimization, leading to unauthorized memory access. The second issue involved the handling of animated WebP images, where mismatched image data could result in an out-of-bounds write, breaching the V8 sandbox.
The third flaw was identified in Chrome’s Crashpad crash-reporting system. It involved a faulty memory read retry mechanism that assumed static page content, leading to memory corruption outside the renderer sandbox. Each of these flaws played a critical role in the exploit’s success.
Implications and Future of Cybersecurity
XBOW’s team meticulously coordinated the project, selecting targets and validating AI-generated results. When Google identified a known issue in the initial chain, the team adapted by integrating a new bug thanks to a modular approach. The work was completed between August 2 and August 7, illustrating the speed and efficiency of AI-assisted cybersecurity research.
Google’s Chrome Vulnerability Reward Program supports such discoveries by offering significant incentives for identifying serious vulnerabilities. To ensure security, users are advised to keep their Chrome browsers updated. XBOW’s achievement underscores the growing importance of AI in identifying complex software vulnerabilities, suggesting that AI tools should be integrated into regular security testing processes with human oversight.
The path forward for cybersecurity involves leveraging AI’s capabilities while ensuring thorough human review. As the digital landscape evolves, such innovations will be crucial in maintaining the integrity and security of online environments.
