$250k Bounty Awarded for 6-Day AI-Assisted Chrome Zero-Day Chain Escaping Windows Sandbox
Researchers chained three zero-day flaws in Chrome to bypass Windows sandbox protections, earning a $250,000 bounty from Google after a six-day effort.
Key points
- Xbow researchers used OpenAI's GPT-5.6 Sol model to chain three Chrome zero-days into a Windows sandbox escape.
- The exploit affects an estimated one billion users, but Google has already issued fixes for all three vulnerabilities.
- The team completed the work in six days during Black Hat and DEF CON, spending roughly $40,000 on AI token charges.
Security startup Xbow reported chaining three zero-day vulnerabilities in Google Chrome to execute code outside the browser’s sandbox on Windows machines. According to The Register, the researchers utilized OpenAI’s GPT-5.6 Sol model to assist in building the exploit chain, which could impact approximately one billion users worldwide.
Google has fixed all three flaws and awarded the Xbow team a $250,000 bounty, its highest payout for a full-chain Chrome exploit. The Register notes that the human researchers, including Brendan Dolan-Gavitt and three colleagues, spent just six days developing the attack during the Black Hat and DEF CON conferences while incurring about $40,000 in AI token costs.
Methodology and Speed
Xbow CEO Oege de Moor highlighted the speed of the development process, noting that intelligence agency veterans previously required six months to achieve similar access. The Register reports that the team completed the work in six days by combining human expertise with AI assistance. Researchers provided context and chose targets, while AI agents searched source code, tested hypotheses, and developed proof-of-concept stages for the exploit components.
Scope of Exposure
The vulnerabilities allowed attackers to bypass Chrome’s sandbox barriers, which are designed to contain compromised code and prevent full system takeover. According to Xbow’s estimates, the exploit chain affects roughly one billion Chrome users globally. The Register states that the successful demonstration proves the effectiveness of using publicly available AI models to accelerate the discovery and chaining of complex software vulnerabilities.
Defender's checklist
Organizations should verify that all Windows devices running Chrome have received the latest browser updates, as Google has confirmed fixes for these specific flaws. Security teams should monitor logs for unusual process spawning or code execution attempts originating from the browser, which could indicate an attempt to exploit similar sandbox escape techniques.
Operational impact
After an event like this, leadership should ask IT teams whether all endpoints are automatically updating browser software. Organizations must verify that their patch management processes can deploy critical fixes within hours of release. Managers should ensure that security operations centers are aware of new exploit techniques to update detection rules. Staff in procurement should review vendor security practices, particularly regarding how suppliers handle rapid vulnerability disclosures.
Background: Patch management
Patch management applies software updates to fix known issues, while vulnerability management identifies all weaknesses, including misconfigurations, and prioritizes them by risk. You need both. Patching fixes code flaws, but vulnerability management ensures you address the highest risks first, even when patches are unavailable or unnecessary.
Read the full guide: Patch Management vs Vulnerability Management: The Critical Distinction
What to do and how to stay safe: Google Chrome
- Ensure all employee devices are set to automatically update Chrome and other browsers to the latest version immediately.
- Check that your endpoint detection tools are configured to alert on unexpected code execution from browser processes.
- Review access controls to limit what applications can run on user workstations, reducing the impact of any sandbox escape.
- Monitor vendor security advisories for updates on how AI-assisted attacks are evolving and adjust your monitoring accordingly.
Step-by-step guide: Unpatched Software Prevention Checklist: Stop Exploits Before They Start
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the researchers use AI to find the vulnerabilities alone?
No, according to the source material, human researchers chose targets and provided context while AI agents helped search code and test hypotheses.
Is there a fix available for these Chrome vulnerabilities?
Yes, Google has fixed all three zero-day vulnerabilities and issued updates to address the flaws.
How much did the researchers earn for this discovery?
The Xbow team received a $250,000 bounty from Google for the full-chain exploit.
