"Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!"
XBOW's six-day sprint at Black Hat and DEF CON
Security firm XBOW says one researcher built a full Chrome exploit chain in six days, between Sunday, August 2, and Friday, August 7, during the Black Hat and DEF CON conferences in Las Vegas. The sprint followed months of earlier planning—the company set the task at a January staff meeting in Malta—and came after a prior full Chrome chain that took two months to produce. XBOW reports the six-day run used about $40,000 in AI compute charges by the company’s own usage logs.
Three then-unknown Chrome bugs chained into full code execution
XBOW chained three bugs across Chrome's multiple protection layers to execute code on a Windows machine when a user merely loaded a page. According to XBOW and Google’s release notes, the stages were:
- an initial memory-control vulnerability inside Chrome’s JavaScript engine (V8);
- a second bug in the code that reads animated WebP images that used that memory control to break out of V8’s inner sandbox and perform a single precise write to system memory; and
- a third bug in Crashpad, Chrome’s crash handler (which runs outside the sandbox), that turned that one write into full code execution on the machine.
Google’s release notes credit Brendan Dolan-Gavitt of XBOW for two of the reported bugs. Both publicly identified bugs were fixed in Chrome 152 releases—one in 152.0.7977.65 on August 25 and the other in 152.0.7977.82 on September 3. XBOW says the bugs were never used against Chrome users.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadGPT-5.6 Sol agents accelerated discovery and development
XBOW directed AI agents running OpenAI’s publicly available GPT-5.6 Sol model to search Chrome’s source code, test ideas, build proofs of concept, and draft exploit components. The company distinguishes the roles: the AI agents handled searching, testing, and first drafts, while human researchers chose targets, supplied context, challenged agent output, and decided which pieces to join into a chain. Brendan Dolan-Gavitt wrote that before large language models, a Chrome full chain would take a four-person team 6–9 months to produce; the XBOW team’s first submission took two months, and the awarded chain took six days.
Google’s fixes, patching advice, and reward details
Google has confirmed and fixed all three bugs and awarded XBOW the top $250,000 reward for a full Chrome exploit under the Chrome Vulnerability Reward Program rules updated in 2026. XBOW calls this the first full-chain Chrome reward under the 2026 rules and the first such reward to an autonomous security company. Google’s program pays up to $250,000 for a full-chain exploit and awards at most four of those each year.
Two of the identified bugs carry public identifiers and were fixed in the Chrome 152 cycle; the WebP-stage bug was fixed in the same cycle but has no confirmed public identifier. XBOW assigned CVE-2026-85045 to the WebP stage in its announcement, but Google and XBOW’s own technical write-up assign CVE-2026-85045 to the V8 (JavaScript engine) bug. Chrome updates automatically, but fixes take effect only after a browser restart; the actionable step for users is to relaunch Chrome and confirm the version is 152.0.7977.82 or later.
What this means for technologists, policymakers, and end users
- Technologists and security teams: XBOW’s founders and researchers underscore a lower technical and financial bar: founder Oege de Moor said the six-day run cost about $40,000 in AI charges, and Dolan-Gavitt warned the speed and cost reduction mean defenders must adjust. Teams will watch for rapid, LLM-assisted exploit development, and prioritize patch deployment and restart policies.
- Policymakers and procurement leaders: the incident intersects with program-level changes—Google’s 2026 reward rules and the cap of four full-chain rewards per year—highlighting how vendor programs and incentives can shape researcher behavior and disclosure timing.
- End users and IT administrators: before fixes shipped, XBOW estimated that about 1 billion people running Chrome on Windows were exposed to this class of attack. The immediate, practical step remains to relaunch Chrome and verify the version is 152.0.7977.82 or later.
XBOW framed the case succinctly: "It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months," founder Oege de Moor wrote. Brendan Dolan-Gavitt’s blunt reminder closes the record: "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain! Defend accordingly."
