Home / Technology / AI Uncovers Major Chrome Flaw, Earns $250K from Google
AI Uncovers Major Chrome Flaw, Earns $250K from Google
13 Oct
Summary
- An AI platform earned $250,000 for discovering a full-chain Chrome exploit.
- The exploit chained three unknown bugs, bypassing Chrome's sandbox security.
- This vulnerability could have affected one billion Chrome users on Windows.
An autonomous offensive security company, XBOW, has received a $250,000 reward from Google's Chrome Vulnerability Reward Program for discovering a critical exploit. This marks the first full-chain Chrome award under Google's 2026 rules and the first for an autonomous platform.
Over six days, XBOW's AI and a security researcher collaborated to build a complete Chrome exploit for Windows. The exploit chained three previously unknown bugs, enabling code execution outside Chrome's sandbox. This level of access could allow attackers to install malware, steal credentials, or gain further network access without user interaction.
The discovered vulnerabilities affected a critical path for an estimated one billion global Chrome users on Windows. XBOW reported all bugs to Google, which confirmed and fixed them. The company plans to use the reward to help secure NGOs.
This achievement highlights the potential of combining advanced AI models with human expertise in offensive security. The speed at which the exploit was developed, taking an estimated $40,000 in compute and six days, contrasts sharply with traditional methods.
The exploit involved three stages: a bug in Chrome's V8 JavaScript engine, a flaw in the animated-WebP decoder (CVE-2026-85045), and a vulnerability in the Crashpad crash handler (CVE-2026-78952). These combined to allow code execution triggered simply by loading a webpage.
