AI Agents Built a Full Chrome Exploit Chain in Six Days — Patch and Relaunch Now
Security firm XBOW says its researchers used AI agents running OpenAI's publicly available GPT-5.6 Sol model to assemble a working, three-bug exploit chain against Google Chrome on Windows in six days. Google has confirmed and fixed all three flaws and paid XBOW its maximum $250,000 full-chain reward. The bugs were patched before disclosure, and XBOW says none was used against real users.
What happened
A "full chain" stitches several bugs together so that simply loading a web page is enough to run code on the victim's computer — no click, no download. Chrome is built to stop exactly that, using two layers of sandboxing. XBOW's chain got through both:
| Stage | Component | Identifier | Fixed in |
|---|---|---|---|
| 1 | V8 JavaScript engine | CVE-2026-85045 | 152.0.7977.82 (3 Sep) |
| 2 | Animated WebP image decoder | No public CVE confirmed | Chrome 152 cycle |
| 3 | Crashpad crash handler | CVE-2026-78952 | 152.0.7977.65 (25 Aug) |
- V8 gave the attacker control over memory inside the JavaScript engine.
- The WebP decoder flaw turned that into an escape from the inner sandbox and a single, precise memory write.
- Crashpad, which runs outside the sandbox, converted that write into full code execution on the machine.
Both bugs with public identifiers are rated high severity. Reporting on the WebP stage is inconsistent: the CVE sometimes attached to it is the one Google assigns to the V8 bug, so treat the WebP fix as "shipped in Chrome 152" rather than tied to a specific CVE.
Why it matters
The headline is speed and cost, with context. The awarded chain was built in a sprint during Black Hat and DEF CON in early August, but it came after months of groundwork — XBOW's first full Chrome chain took about two months. By the company's own usage logs, the six-day run cost roughly $40,000 in AI compute.
XBOW is clear about who did what. The agents searched Chrome's source, tested ideas, built proofs of concept and drafted the exploit. A human researcher, Brendan Dolan-Gavitt, picked the targets, supplied context, challenged the agents' output and decided how the pieces fit together. When one component turned out to duplicate a bug Google already knew about, the modular design let the team swap it out and keep the chain intact.
The comparison XBOW draws: a chain like this used to take a small team six to nine months. If a well-funded attacker can now get there in under a week for the price of a used car, the window between a browser bug existing and being weaponised shrinks — and so does the margin defenders have for slow patching. XBOW estimates around a billion Windows Chrome users were exposed before the fixes shipped; that figure is the company's, not an independent measurement.
What to do
- Relaunch Chrome. Chrome downloads updates on its own, but the fix only applies after a restart. Confirm
chrome://settings/helpshows 152.0.7977.82 or later. - Enforce it centrally. Use Chrome Enterprise / Group Policy (
RelaunchNotification,RelaunchNotificationPeriod) to force restarts within a set window, and report on fleet versions rather than trusting auto-update. - Cover Chromium-based browsers too. Edge, Brave, Opera and embedded Chromium/Electron apps pick up V8 and WebP fixes on their own schedules — check each vendor's release notes.
- Shorten browser patch SLAs. Treat high-severity browser fixes as days, not weeks. AI-assisted exploit development makes "we'll catch it next cycle" a riskier bet.
- Assume the browser can fall. Keep EDR on endpoints, limit local admin rights, and segment so that one compromised workstation doesn't open the whole network.
The takeaway isn't that AI replaced exploit developers — a skilled human still steered every step. It's that the cost of producing a top-tier browser exploit just dropped sharply, and patch discipline has to keep up.
Originally reported by The Hacker News (Swati Khandelwal, 14 Oct 2026). This is 4Tify's independent summary and analysis.