Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

Summary: XBOW researchers chained three then-unknown Google Chrome bugs into a full exploit that runs code on a Windows machine when a user merely loads a web page, building it in six days with AI agents running OpenAI's public GPT-5.6 Sol model. Google confirmed and fixed all three bugs and paid XBOW its top $250,000 full-chain reward, with the two publicly identified bugs fixed in Chrome 152.0.7977.65 on August 25 and 152.0.7977.82 on September 3.
Key Takeaway: The six-day run cost about $40,000 in AI charges and crossed both of Chrome's nested sandboxes, against a prior estimate of 6-9 months for a team of four - and before the fixes, an estimated 1 billion Chrome-on-Windows users were exposed to this class of attack.

Read the original at The Hacker News ↗

Mentions: CVE-2026-85045