Google Awards $250,000 for Innovative AI-Driven Exploit Chain Developed by XBOW
In a significant development within the tech landscape, Google has awarded a substantial sum of $250,000 to XBOW, a cybersecurity research team, for their groundbreaking achievement in creating an AI-assisted exploit chain. This new exploit chain successfully enabled code execution beyond the confines of the Chrome browser’s renderer sandbox on Windows platforms. The award signifies an important milestone as it represents the first full-chain payout allocated under Google’s vulnerability reward program, which was initiated in April 2026.
XBOW, boasting a talented team of researchers, has effectively addressed three critical vulnerabilities in their exploit chain, all of which have been subsequently patched. The collaborative effort behind this project reflects not only the technical prowess of XBOW but also highlights the integration of artificial intelligence into modern cybersecurity initiatives.
The awarded exploit was developed over a concentrated six-day period, from August 2 to August 7. During this time, XBOW engaged in meticulous research and experimentation, building upon earlier unsuccessful submissions. The team estimated that their endeavors incurred approximately $40,000 in application programming interface (API) charges throughout this research campaign.
The research team behind this accomplishment consists of talented individuals including Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers. These researchers combined their expertise with advanced AI agents to enhance their vulnerability discovery and exploit development processes. This innovative blend of human intellect and automated assistance has opened new avenues in cybersecurity research, enabling researchers to tackle vulnerabilities in a more efficient manner.
Among the tools utilized during their research was OpenAI’s publicly available GPT-5.6 Sol model. The team implemented this tool to assist in exploring source code, testing various hypotheses, producing proofs of concept, and crafting the different stages of their exploit. The strategic selection of targets involved in the project was paramount, as the researchers continuously assessed their findings, redirected investigations, and integrated essential components to refine their approach.
The resultant demonstration of their work was a striking success, as the exploit was able to launch the Windows Calculator application directly from a webpage using a signed version of Chrome Beta. This accomplishment vividly illustrated the exploit’s capacity to execute code beyond the protective layers of the renderer’s sandbox.
The first vulnerability exploited in this chain concerned Maglev, an optimizing compiler used within the V8 JavaScript engine. An error during Maglev’s deoptimization process, which reconstructs JavaScript objects in response to failed optimization assumptions, led to the incorrect reuse of a mutable HeapNumber as if it were immutable. This inconsistency resulted in separate objects sharing the same boxed numeric value, thereby allowing unauthorized read and write access across the four-gigabyte pointer-compression cage within V8.
In the second phase, the researchers targeted animated WebP decoding through the WebCodecs ImageDecoder API. By breaching memory confines within the V8 cage, the attackers could continue to write to image bytes that Blink—a web browser engine—assumed were exclusively controlled. Unforeseen alterations to these bytes post-frame geometry caching created a mismatched timing issue that effectively combined the geometry of one image with the payload of another, causing an overflow in native bitmap allocation and providing a pathway to target memory writes.
The final vulnerability address involved Crashpad, Chrome’s crash-reporting tool, which operates outside the renderer’s boundaries. Unexpected behaviors during memory reading processes led to buffer overflows, corrupting an adjacent object within Crashpad. Through skillful manipulation, the researchers redirected legitimate handler functionalities to launch the Windows Calculator while conforming to standard control flow and shadow stack protections, resulting in unsandboxed execution of Windows code and extending their control beyond web content.
The subsequent patches implemented by Google remedied these vulnerabilities, specifically by preventing the reuse of mutable HeapNumbers, restricting WebP output buffers to remain within their designated bitmap limits, and capping Crashpad’s retry attempts at their original requested lengths.
The modular design adopted by XBOW further facilitated the ability to replace any duplicate vulnerabilities without necessitating a full rebuild of the exploit chain. Users of the Chrome browser are encouraged to update and relaunch their software to ensure the application of these essential fixes.
This successful six-day exploit campaign, while expedited, underscored the critical role of prior work, expert oversight, and a repository of reusable techniques cultivated through human ingenuity. The advancement of artificial intelligence in cybersecurity stands as a testament to what can be achieved in vulnerability research and code enforcement, marking a significant chapter in the ongoing battle against digital threats.