Breaking

XBOW Researchers Leverage GPT-5.6 Sol to Discover Three-Bug Chrome Exploit Chain in Six Days, Secure $250,000 Google Bounty

October 14, 2026 at 07:49 EDT

AI Agents
Security

Researchers at offensive security firm XBOW have demonstrated a new frontier in vulnerability research: using AI agents powered by OpenAI's GPT-5.6 Sol model to discover and chain together three previously unknown bugs in Google Chrome, enabling arbitrary code execution on Windows systems. The work, completed in just six days in August 2026, earned a $250,000 bounty from Google's Chrome Vulnerability Reward Program.

BREAKING SECURITY NEWS

AI-Powered Vulnerability Research Shortens Exploit Timeline

Researchers used OpenAI's GPT-5.6 Sol model to discover and chain three Chrome bugs in six days, earning a $250,000 Google bounty and raising questions about the future speed of security research.

Vulnerabilities in V8 Maglev, WebP decoder, and Crashpad chained together

Days from research start to working exploit chain completion

$250K

Google's maximum reward for the critical three-bug exploit

~1B

Potential Chrome on Windows users affected by the chain

How the Exploit Works

1. JavaScript Memory Access: A type-confusion bug in V8's Maglev compiler allows attackers to forge memory references from JavaScript.

2. Sandbox Boundary Crossing: The WebP image decoder flaw (CVE-2026-85045) lets the exploit cross from the V8 sandbox into native code space.

3. System Code Execution: A use-after-free in Crashpad, running outside the renderer sandbox, enables arbitrary code execution on the host Windows system.

Human-AI Collaboration Model

AI Agents (GPT-5.6 Sol)
• Searched source code
• Generated PoC code
• Tested hypotheses
• Drafted exploit code

Human Researchers
• Set strategic direction
• Selected promising areas
• Validated findings
• Made final decisions

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.