Advanced browser exploitation can take months of specialized work. At XBOW, researcher Brendan Dolan-Gavitt and AI agents compressed much of that work into six days.
Between August 2 and August 7, Dolan-Gavitt worked with agents powered by OpenAI’s GPT-5.6 Sol model to investigate different parts of Chrome in parallel. According to XBOW’s account of the Chrome research, the awarded chain grew out of a broader project involving researchers Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee and Willem Pinckaers. Dolan-Gavitt and the agents then built the replacement exploit that ultimately earned the reward.
Their work connected three vulnerabilities into an attack that could begin with an ordinary webpage and reach code execution outside Chrome’s renderer sandbox on Windows. Google later verified the updated exploit and awarded XBOW $250,000 through its Chrome Vulnerability Reward Program. Google’s public Chromium record confirms both the reproduced exploit and the reward.
XBOW says this was the first $250,000 Chrome full-chain award under Google’s 2026 rules. The company disclosed more details about the award and its potential reach in its Business Wire announcement.
But the six-day timeline gives this research much of its significance for security practitioners. XBOW estimates that compute for the successful campaign cost about $40,000, while researchers continued to choose targets, check findings and decide how individual exploit stages should connect.
Even Dolan-Gavitt acknowledged how quickly that pace is changing expectations around advanced security research.
“The speed is challenging even for us trying to understand how security is changing,” he wrote in his technical breakdown of the exploit.
For security teams, that gives the project value beyond another large bug bounty. It shows how AI can expand the amount of complex research one experienced person can direct in a short period, while human judgment continues to shape where that work goes.
AI Agents Split Chrome Exploit Research Across Multiple Tasks
XBOW did not give one AI agent a broad instruction to compromise Chrome and wait for a finished exploit.
Researchers divided the work into narrower campaigns. According to Dolan-Gavitt’s technical account, agents searched source code, tested hypotheses, developed proofs of concept and worked on separate exploit stages. XBOW researchers chose targets, supplied additional context, challenged results and decided which components were useful enough to connect.
That structure allowed several lines of investigation to move at the same time.
And it became especially useful when an earlier version of the chain ran into a problem. One vulnerability XBOW planned to use had already been reported to Google, which meant the team needed another route.
Instead of rebuilding everything, the researchers replaced that stage. They had already separated the exploit into independent components and prepared alternative paths, which gave Dolan-Gavitt and the agents room to continue without discarding the rest of the work.
Google’s Chromium thread documents that change. XBOW replaced the original Gin vulnerability with an animated WebP flaw and submitted an updated chain combining the Maglev vulnerability, the WebP stage and the Crashpad issue. A Google security engineer later confirmed that the revised chain successfully launched Calculator outside Chrome’s renderer sandbox.
Oege de Moor, founder and CEO of XBOW, sees that ability to connect separate findings quickly as one of the more important changes AI brings to vulnerability research.
“Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path,” de Moor said.
His point matters for teams that still rely heavily on individual vulnerability ratings. A flaw that appears manageable on its own can become much more serious when another weakness provides the access required for the next stage.
As AI-assisted research gets faster, security practitioners will need to spend more time understanding how findings connect and what an attacker could achieve once those connections are proven.
Three Bugs Created a Full Chrome Sandbox Escape
The successful chain crossed Chrome’s security boundaries in stages.
The first vulnerability affected Maglev, an optimizing compiler inside Chrome’s V8 JavaScript engine. It allowed the exploit to gain read and write access throughout V8’s protected memory area.
Google tracks that issue as CVE-2026-85045 and credits Dolan-Gavitt as the reporter. The public Chromium report for CVE-2026-85045 classifies it as a high-severity vulnerability.
That access gave the researchers control inside the V8 sandbox, but they still needed a route into native browser memory.
A second vulnerability involving Chrome’s handling of animated WebP images provided that step. XBOW’s technical research explains how the team used the flaw to turn access inside V8 into a chosen write outside the V8 sandbox. Dolan-Gavitt’s technical analysis goes deeper into the mechanics of that WebP stage.
Google tracks the WebP issue separately under Chromium issue 548509153. That matters because the Business Wire release associates CVE-2026-85045 with the animated WebP stage, while Google’s own Chromium records assign CVE-2026-85045 to the Maglev vulnerability. Google’s records provide the cleaner reference for the individual flaws.
After crossing the V8 boundary, the researchers still faced Chrome’s renderer sandbox.
The last vulnerability affected Crashpad, Chrome’s crash-reporting component on Windows. A flaw in Crashpad’s memory-reading logic could cause a retry operation to write more data than its caller expected under specific conditions.
Because Chrome’s Crashpad handler operates outside the renderer sandbox, the researchers could use that vulnerability to complete the escape. Google assigned the flaw CVE-2026-78952 and again credits Dolan-Gavitt as the reporter in its public Crashpad vulnerability record.
Once the stages worked together, the chain could move beyond JavaScript running inside a Chrome tab and reach code execution outside the browser sandbox.
Google independently verified the updated chain on Windows. Its Chromium record says the proof of concept launched Calculator through Chrome’s Crashpad handler, confirming that the exploit had crossed the expected security boundary. The Chrome Vulnerability Rewards Program panel later approved the $250,000 payment.
Calculator served as a harmless demonstration. In a malicious campaign, reaching the same level of code execution could support a much more damaging payload.
XBOW estimates that roughly one billion people were using Chrome on Windows before the relevant fixes. The company says it found no evidence that attackers used the vulnerabilities against Chrome users. XBOW’s award disclosure provides the company’s full account of that assessment.
Human Expertise Guided AI Research
The six-day result can easily be reduced to a story about AI learning to hack Chrome. The research itself gives a more useful picture.
AI agents handled a considerable amount of source-code investigation and experimentation. But researchers still decided which parts of Chrome deserved attention, supplied technical context, checked the agents’ work and worked out how separate findings could become a reliable exploit.
And when part of the original chain could no longer be used, planning made a difference. The researchers had designed cleaner boundaries between exploit stages and prepared alternatives, which allowed them to change direction without throwing away the rest of the work.
De Moor underscores how central that combination was to the result.
“This disclosure highlights the speed and what is possible when human ingenuity and decades of offensive security experience is combined with the world’s most capable models,” he said.
For security practitioners, that provides a more practical model for adopting AI. Teams can give agents focused investigations, let them examine more code and test more possibilities, then have experienced researchers validate the findings and decide where deeper work makes sense.
Dolan-Gavitt’s role in the project makes that particularly clear. The agents increased how much technical work could happen in parallel, while his experience helped determine which results were useful and how those components should work together.
That also shifts some of the researcher’s workload. A skilled practitioner can direct several investigations at once and spend more time reviewing promising results instead of manually carrying out every stage.
But expertise still matters. Researchers need enough understanding of the target to recognize weak results, redirect work that reaches a dead end and identify when separate findings can form a realistic attack path.
$40,000 in Compute Compressed Exploit Development
XBOW reconstructed usage from archived logs and estimates that the six-day campaign consumed roughly $40,000 in API charges.
That is a sizeable research bill. But the comparison changes when the target is advanced browser exploitation, where highly specialized researchers may spend months developing and connecting vulnerabilities.
De Moor argues that AI is already reducing the time and human effort involved in parts of that work.
“It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months,” he said.
Access to compute alone will not reproduce this result. XBOW brought experienced security researchers, knowledge of browser exploitation and earlier technical work into the project.
Still, reducing researcher time changes the economics.
A small security research team that can run several investigations in parallel may cover more code and test more potential attack paths without increasing headcount at the same rate. As the models improve, that can make advanced research practical for more organizations.
It can also shorten the window software teams have to react.
XBOW deliberately chose a publicly available OpenAI model rather than a security model available only to a restricted group. De Moor’s full account of the Chrome project argues that organizations should respond by applying similar capabilities to their own software before someone else starts looking for exploitable paths.
That gives security leaders a practical place to start. Internal teams already understand their applications, architecture and critical systems. AI-assisted testing can help them investigate more of that environment and focus experienced researchers on results that carry real security impact.
Security Teams Need Better Exploit Validation
Faster vulnerability discovery creates limited value if it only adds more findings to already crowded security backlogs.
Teams need better ways to determine which findings can actually lead to compromise.
That means looking beyond individual severity scores. A moderate vulnerability may require immediate attention when another weakness turns it into one stage of a larger exploit path.
Chrome provides a clear example because no single vulnerability produced the final outcome. The researchers had to connect capabilities across multiple security boundaries before they reached code execution outside the browser sandbox.
Security testing can follow the same logic.
Teams can use AI agents to investigate promising findings, test how weaknesses interact and determine what access those combinations provide. Experienced security practitioners can then review the evidence and prioritize remediation around proven attack paths rather than long lists of disconnected scanner results.
Clint Gibler, Head of Cyber Research at OpenAI, points to the XBOW project as an example of how models can support that type of work.
“A single XBOW researcher used our models to uncover a chain of vulnerabilities that Google has now fixed,” Gibler said.
According to the announcement shared by XBOW and OpenAI, OpenAI is working with security researchers and industry partners to put these capabilities into more security practitioners’ hands.
Organizations also need to look at testing frequency.
An annual penetration test captures an application at one point in time. Software can change significantly before the next assessment arrives.
If AI-assisted research can reduce parts of advanced vulnerability work to days, high-risk applications need security testing that runs closer to development. Teams can retest important attack paths as code changes, investigate findings sooner and check if apparently separate weaknesses work together.
AI does not remove the need for review. Researchers still need to verify findings, understand technical and business impact and decide which results require immediate action.
But it can give them more evidence to make those decisions faster.
Chrome Updates Close This Exploit Path
For Chrome users and organizations managing browsers, immediate action is straightforward.
Google has fixed the vulnerabilities used in XBOW’s chain. Its Chromium records show the Maglev and Crashpad issues as fixed, while Google’s full-chain report confirms that fixes broke the attack path.
Chrome normally downloads updates automatically, but an installed update requires a browser relaunch before it takes effect. XBOW recommends keeping Chrome current and restarting it when an update becomes available. XBOW’s Chrome research disclosure includes that recommendation alongside the company’s broader guidance for software teams.
Organizations managing endpoints should also make sure current Chrome releases reach devices and that browser restarts do not remain postponed for long periods.
Patching closes this particular exploit path. The broader change is happening in how quickly researchers can search for the next one.
AI agents can already examine large codebases, test hypotheses and develop exploit components alongside experienced researchers. XBOW’s Chrome work shows how much more research a skilled person can direct when those activities happen in parallel.
And six days is fast enough for security teams to adjust how quickly they test, validate and fix their own software.
