Six days and $40,000 of GPT-5.6 compute chained three Chrome bugs into a full takeover, and the patch is waiting on your next browser restart
A public OpenAI model and about $40,000 of compute chained three Chrome bugs into an exploit that escapes both of the browser's sandboxes; here is what was measured, what was recalled, and which part of your own product has to move first.
An attacker who lands a full-chain exploit takes your whole machine. They read your email, your bank, and every password you type. You do not have to download anything or click a phishing link — opening the wrong page is enough. 1
On 13 October, the security startup XBOW published how it built one of those chains against Chrome. Chrome puts layers between a web page and your computer, and a full chain is the set of bugs that opens every door between them. 1
It took three bugs and six days. The agents running OpenAI's GPT-5.6 Sol searched Chrome's source, tested hypotheses and drafted the exploit; the four researchers chose targets, checked the work and decided which pieces to join. 2
XBOW puts the compute bill at roughly $40,000, reconstructed from its archived agent logs. Google fixed all three bugs and paid $250,000, its top reward. 1
The fix is already shipped, and it is inert until you restart your browser. 3
Agorà Intelligence walks through the chain and what enterprises should change.
Loading content card…
What the chain actually crossed
Chrome is defended in layers, and each layer is meant to hold on its own. 1
Inside the browser, the JavaScript engine V8 confines its own memory in what the V8 team calls a sandbox — a reserved four-gigabyte region where objects refer to each other by offset. 4
Nothing outside that region is addressed directly. Anything native — an operating-system object, executable code — is reached through a pointer table that lives outside the cage, so corrupting memory inside it is not the same as running code. 4
Around that sits the renderer sandbox, an operating-system boundary; the renderer is the browser process that draws the page. Even native code running inside the renderer cannot touch the rest of the machine. 3
The chain crossed both boundaries and the crash handler behind them, in three stages that were developed as separate campaigns.
| Stage | The flaw | What it bought |
|---|---|---|
| JavaScript engine | Maglev, V8's mid-tier optimizing compiler, reused a mutable boxed number during deoptimization | Read and write across V8's four-gigabyte pointer-compression cage |
| V8 sandbox | Animated WebP decoding combined cached image geometry with changed image bytes | One chosen native write outside the cage |
| Renderer sandbox | Crashpad, Chrome's crash handler, treated a failed read from a supposedly frozen renderer as a stable observation | Code execution in the unsandboxed crash handler |
The first stage is the kind of bug a compiler writes about itself. Optimized code assumes things about the values it handles; when an assumption stops holding, V8 rebuilds the objects it had been representing only as numbers. On this path it built one shared, mutable number where the compiler's own rules say only immutable constants may be shared. 2
Changing one object's number then changed the offset an optimized load used, while an earlier bounds check still believed the access was safe. Three such loads were enough to rebuild a working array and walk the whole cage. 2
The second stage is the one worth reading twice. It does not attack the sandbox at all. It exploits something the V8 sandbox deliberately does not enforce — that a detached buffer's bytes stay frozen — and that the image decoder assumed it could trust. 2
Two valid animated images, placed in the same memory, made the decoder read one image's compressed data and describe the output using the other image's cached frame rectangle. 2
The third stage defeats the freeze that is supposed to make the crash handler's reading of a crashed renderer safe. A Windows thread created with a freeze-bypass flag keeps running while the process is suspended, so the payload flipped a page between inaccessible and writable between the handler's read and its retry. 2
Crashpad's retry then copied more bytes than its caller had asked for, overwriting the allocation next to it — a live writer object the handler would later use to read memory out of the renderer. 2
The six days, itemised
XBOW's own comparison is the one to hold on to. Before language models, Dolan-Gavitt writes, a Chrome full chain took a team of four somewhere between six and nine months. XBOW's own first submission took two months. The awarded one took six days. 2
The work ran from Sunday 2 August to Friday 7 August, while the team was in Las Vegas for Black Hat and DEF CON. XBOW deliberately used a model anybody can rent, not a specialist security model behind an access gate. 2
The task was split into parallel campaigns with narrower goals — broad vulnerability search, the V8 memory-corruption bug, the V8 sandbox escape, the renderer sandbox escape, and integration — rather than one agent asked for an exploit end to end. 2
Each stage got a clean interface and a backup route. That decision paid off directly: XBOW's first chain was disqualified because Google already knew one of its bugs, so the team swapped in an alternative stage instead of rebuilding. 1
That is the practice worth stealing. A modular exploit is a build system with replaceable parts, and the same structure is what lets a security team retire one detection when it stops working without redoing the rest. 2
The researcher who wrote the technical account says the pace unsettled the team that set it. "The speed is challenging even for us trying to understand how security is changing," Dolan-Gavitt writes. 2
The company's own summary of the return is blunt. $40,000 of compute bought a $250,000 reward, and one research lead says a professional team would have needed about a year. 15
Why Google pays $250,000 for this
The figure is not a marketing number. It is published, in a table, on Google's bounty rules. 6
Google pays $250,000 for a demonstrated exploit against a shipping version of Chrome that succeeds from web contents, and $200,000 if the exploit needs MojoJS enabled — the browser's privileged internal interfaces opened up to a page. 6
The number also comes with a budget. Under the rules introduced in April 2026, at most four such bonuses will be awarded in the year, and as of 13 October three had been. 6
If your own product runs a security programme, that is the cheapest thing in this piece to act on. A four-a-year cap sets what the market expects a maximal finding to be worth, and it tells you how many of those findings the largest buyer of them expects to see. 6
Google's rules have also started accounting for machine-written reports. Submissions made with agents must follow a published agent security policy, and reports that merely suggest a vulnerability from static analysis, reading code without running it, are not eligible. 6
The reward for this chain was announced by XBOW's chief executive in a post that drew 783,000 views, and reshared by OpenAI's president, whose own post drew 595,000. 78
That reach is part of the story. The vendor's argument — that restricting powerful models is the wrong question, because this one is already public — is being made to a very large audience. 1
Where the evidence stops
Four separations decide how much weight this deserves.
Measured versus remembered. The six-to-nine-month and two-month figures are XBOW's own recollection of its own work, and the six-month comparison is one intelligence veteran's anecdote relayed by the company's chief executive. 1 No outside party has reproduced any of the timings.
Measured versus forecast. XBOW writes that within a year, each of the three bugs could plausibly be found by agents working on their own. 1 That is a prediction, made by a company building an autonomous product for exactly this market. 1
The vendor's claim versus the platform's record. XBOW describes its award as the first under the April 2026 rules. Google's page records three of the four 2026 bonuses awarded as of the same day. 6
The claim versus the published measurement. A September benchmark tested coding agents on a harder question than finding bugs: turning a known vulnerability into a working exploit primitive against real operating-system kernels. 9
KEX-bench covers 45 tasks drawn from 40 Linux and Windows CVEs, each run in an isolated virtual machine with a deterministic verifier. 9
Without a reference proof of concept — a working demonstration of the bug — the strongest agent configuration solved one of twenty Windows tasks and fourteen of twenty-five Linux ones. Given a reference proof of concept, it solved thirty-one of forty-five. 9
The authors' own summary of the gap: agents reach crashes but fail to shape the state of the operating-system kernel, its core, into exploit primitives — the small pieces of capability each stage of a chain is built from. 9
That is the scaffolding the headlines drop. XBOW's agents worked inside a campaign designed by four people who had built a Chrome chain before, and the second attempt began from everything the first taught them. 2
The academic picture of why this class of work is hard supports the same reading. A study of 241 JavaScript-engine vulnerabilities from 2017 to 2024 found that exploiting them depends on cascading chains, where a logical error has to propagate into a memory-safety violation before it is worth anything. 10
Three bugs, joined deliberately, is not a surprising shape for this target. It is the shape the literature describes. 10
Where your team sits
- You ship any Chromium surface. Chromium is the open-source engine Chrome is built on. An Electron desktop app, an embedded WebView, an in-app browser, a kiosk build and a browser extension all inherit this code. Write the list down; most product teams cannot produce it from memory. 2
- You own the update path. Chrome auto-updates, but a fix only takes effect once the browser is relaunched — the exact version to be on is 152.0.7977.82 or later. 3 If your product is a long-running client, know how it restarts. 1
- You own a patch SLA. Four full-chain bonuses exist in 2026 and three are gone. The next question for your risk register is what a six-day, $40,000 exploit does to a ninety-day remediation window. 6
- You set the security budget. The same capability that found these bugs can be pointed at your own compiled software, and XBOW says it is building that product now. 1
- You buy model access. OpenAI's Daybreak tiers have existed since August: Daybreak Blue removes system-level cyber guardrails on GPT-5.6 Sol for approved defenders, and Daybreak Red carries a cyber-specific model built to reduce refusals on exploit-chain work. 11 Ask your provider what your team is already entitled to.
- You run a bounty programme. Google's page is the reference for what a maximal finding costs. If your top tier has not moved in three years, you are now the cheap option. 6
A watching brief
- Whether the fourth 2026 full-chain bonus is claimed, and by whom. Google's rules cap them at four and three are spent. The identity of the fourth claimant is the cleanest available read on how far this has spread beyond research labs. 6
- Whether the next chain is built with agents choosing their own targets. XBOW states plainly that the humans selected the strategy here. The moment a chain is built with agents doing that too, the "within a year" forecast stops being a forecast. 1
- Whether XBOW publishes the orchestration detail it promised. The company says a fuller account of the campaign's chronology is coming at the end of October. That is where the cost and time numbers become checkable. 2
- Whether the benchmark gap closes. KEX-bench is public and reproducible. If the Windows figure moves off 5% without a reference proof of concept, the human scaffolding in this story is being automated. 9
- Whether Google tightens its agent rules further. The programme already asks agent-assisted reporters to follow an agent security policy, and already refuses static-analysis-only claims. Watch the next rules revision. 6
The decisions, with the clock on them
| Decision | What the sources provide | The constraint that decides it | Act when |
|---|---|---|---|
| Whether to push a browser restart to your users or fleet | A shipped fix that does not take effect until relaunch; Chrome 152.0.7977.82 or later 3 | Whether your client restarts on its own or waits for the user | This week, before the next patch lands on top of it |
| Whether you can name every Chromium surface you ship | A chain that crossed both of Chrome's sandboxes; every Chromium embedder carries the same code 2 | Whether anyone on your team owns the list | At the next dependency review |
| Whether to run agent-assisted testing on your own compiled software | Six days and about $40,000 against a hardened billion-user target; a vendor building the tool, and vendor-gated access tiers already on the market 111 | Scope, data handling and who is allowed to point it at production | When the vendor answers on scope, not before |
| Whether your remediation SLA still fits | A published benchmark where agents reach crashes but not primitives; a vendor predicting solo agent discovery within a year 9 | Your own recovery time from a live exploit, which only you can measure | At the next security review |
| Whether your bounty's top tier is still competitive | Google pays $250,000 from web contents and $200,000 with MojoJS, capped at four a year 6 | The findings you want to attract against the ones you can already afford | Before the next budget cycle |
The chain, the six-day timeline, the three vulnerabilities, the roughly $40,000 compute estimate and the "within a year" prediction all come from XBOW's own two posts of 13 October 2026; the compute figure is the company's reconstruction from its archived agent logs rather than a metered invoice. The Register independently confirmed the chain, the bounty and the Chrome version that carries the fixes, and added the relaunch requirement. The $250,000 and $200,000 tiers, the four-a-year cap and the three-awarded count are read from Google's published programme rules. The sandbox diagram is the V8 team's own. The kernel-exploit benchmark figures and the JavaScript-engine vulnerability study come from preprints posted to arXiv, and they measure a general capability rather than this chain. The six-to-nine-month and six-month comparisons are recollections, and the June-to-August relationship between the two XBOW attempts is the company's own account of its own work.
References
- 1
- 2
- 3
- 4The V8 Sandbox
v8.dev
- 5
- 6Chrome Vulnerability Reward Program Rules
bughunters.google.com
- 7
- 8
- 9
- 10
- 11
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.