Xbow spent $40K on AI and cracked Google Chrome wide open

Summary

Researchers at Xbow USA used OpenAI's GPT-5.6 Sol over six days to chain Chrome vulnerabilities, escaping the V8 JavaScript engine sandbox and then Chrome's operating-system process sandbox to launch a Windows app from a malicious web page. The work cost about $40,000 in AI compute and earned a $250,000 bug bounty from Google under the new 2026 rules. Google fixed the flaws after Xbow reported them.

Mitigation

Google fixed the flaws after Xbow presented its findings to the company.

Related items

• MediumHallucinated domain in official OpenAI skill underscores AI supply chain risksSame vendor · CSO Online
• InfoOpenAI Saudi national bugging case shows threat to U.S. leadership in AI: DNI ClaytonSame vendor · CNBC Technology
• MediumOpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart ContractSame vendor · The Hacker News
• InfoEmployees using personal ChatGPT at work? Here's what IT admins need to doSame vendor · BleepingComputer
• InfoAI Decision Models and Their Impact on AI SOC PlatformsSame vendor · The Hacker News