XBOW published the technical write-up today for a Chrome full-chain exploit that Google awarded $250,000 under the Chrome Vulnerability Reward Program rules introduced in April 2026. Per XBOW, it is the first full-chain award under those rules and the first granted to an autonomous offensive security platform. The company says the bugs were never used against Chrome users, Google reproduced the chain, and the fixes have shipped.
The chain. Three previously unknown bugs, three stages. First, a Maglev (V8 mid-tier compiler) deoptimization bug let JavaScript get reliable read/write across V8's pointer-compression cage. Second, an animated-WebP decoder bug tracked as CVE-2026-85045 turned that into one chosen native write outside the cage. Third, a Crashpad remote-read bug tracked as CVE-2026-78952 — Crashpad runs outside the renderer sandbox — turned that write into unsandboxed code execution on Windows. In the demo, a page in signed Chrome Beta launched Calculator. Before the fixes, XBOW puts about one billion Windows Chrome users in the blast radius of this class of flaw.
How fast. The awarded chain was built between Sunday, Aug. 2 and Friday, Aug. 7 — six days — with AI agents on OpenAI's publicly available GPT-5.6 Sol model doing the search, PoCs, and early exploit drafts, and XBOW researchers setting targets and swapping stages when the first V8 sandbox escape collided with a prior report. Reconstructing Codex logs, XBOW puts the six-day campaign at roughly $40,000 in API charges. Brendan Dolan-Gavitt wrote the root-cause post. CEO Oege de Moor's companion post names the human team that took the challenge: Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers.
Why buyers should care. A drive-by that clears both the V8 cage and the renderer sandbox is exactly the class of bug enterprise EDR and browser isolation are built to blunt — and the cost curve for finding the next one just dropped. XBOW's point is not that Chrome is uniquely soft. It is that a single researcher with a public model and modular stages can now do in a week what used to take a small team most of a year. Defenders get the same tools. Attackers do too.
What we'd do this morning. Force Chrome (and Edge, which is Chromium) to the latest build and restart the browser — auto-download does not apply the fix until relaunch. Check managed browser policies for a minimum version pin and for whether users can postpone updates forever. If you run VDI or locked-down kiosks, push the Chromium update through your image pipeline today, not next week's patch window. Then treat this as a product-security signal: if you ship a browser-adjacent parser, image decoder, or crash reporter, put an AI-assisted red team on the same stage boundaries XBOW used — mutable-vs-immutable invariants, TOCTOU on transferred buffers, and assumptions that a "frozen" process stays frozen.