XBOW Builds Full Chrome Exploit Chain with OpenAI's GPT-5.6 Sol, Earns $250K from Google

On October 13, cybersecurity firm XBOW said a security researcher, aided by OpenAI's GPT-5.6 Sol model and an AI agent, built a complete Chrome exploit chain from three previously unknown vulnerabilities in six days, earning a $250,000 bug bounty from Google. XBOW described it as the first full-chain Chrome reward under Google's new rules introduced in 2026.

The attack chain first used a V8 JavaScript engine vulnerability to gain memory control inside the sandbox, then exploited a Chrome dynamic WebP decoder vulnerability, CVE-2026-85045, to break out of the sandbox, and finally used the Crashpad vulnerability CVE-2026-78952, which runs outside the sandbox, to achieve full code execution. The chain could be triggered simply by loading a web page, with no extra download or click required.

XBOW said the vulnerabilities could theoretically have affected around 1 billion Windows Chrome users before being patched, and estimated the research consumed about $40,000 in computing resources. The vulnerabilities were reported to Google and have been fixed; XBOW said there was no evidence they had been exploited in the wild.