XBOW Used AI to Hack Google Chrome in Six Days, Earning $250,000

What it is

XBOW's write-up (published 13 Oct 2026) of a full Chrome-on-Windows exploit chain built 2-7 Aug 2026. It ended in code execution outside the browser sandbox, shown by launching Calculator. Google paid $250,000 through the Chrome VRP. The page gives no CVE ids.

How it works

Three bugs chained, each defeating a different boundary:

flowchart LR
    A[Maglev bounds-check bypass] -->|read/write inside V8 sandbox| B[WebP animated decoder heap overflow]
    B -->|native memory, WASM code refs, renderer code exec| C[Crashpad out-of-bounds write]
    C -->|outside sandbox| D[CreateProcessW]

1. V8 Maglev: incorrect handling of certain numeric objects, which the compiler treated as immutable though they were mutable, bypassed array bounds checks. This gave read/write within the V8 sandbox.
2. WebP animated decoder: an image-dimension mismatch caused a heap buffer overflow. The decoder assumed data passed from JavaScript would not change. The overflow reached native memory, allowing manipulation of WebAssembly code references and instruction execution in the renderer (still sandboxed).
3. Crashpad: it assumed a target process was suspended. XBOW kept a thread running and changed memory-page permissions during reads, producing an out-of-bounds write in the Crashpad process, which sits outside the sandbox. By corrupting internal structures and reusing functions already in Chrome, they called CreateProcessW().

The page names the shared root cause as trusting a condition (immutability, unchanged data, suspended state) without ensuring it stays valid. It says this is not simply a missing check.

Preconditions / Affected

• Windows; the demonstrated chain needs all three bugs.
• Chrome versions before 153 are exposed to these specific flaws.

What to do

• Make sure Chrome is 153 or later. Google shipped fixes between August and September 2026.
• For code review, the transferable lesson is to audit for assumptions that hold only at check time. Examples are objects that can be mutated, buffers that JavaScript can change after handoff, and "suspended" processes whose threads or page protections can still change.

Caveats

• Per the page, AI agents (OpenAI gpt-5.6-sol) handled bounded tasks such as reading source, testing hypotheses and building individual components. Humans chose targets, interpreted results and assembled the chain.
• API cost was about $40,000. XBOW's own estimate is that four specialists would need 6-9 months without advanced models. This is a vendor estimate, not an independent measurement.
• The page is a secondary, AI-assisted news article relaying ilSoftware.it and XBOW's report. It gives no technical detail beyond the descriptions above (no code, bug ids or detection guidance).
• The payout is described as the first of this size for a full chain since the VRP rules took effect in April 2026.