Patch Chrome to block $250k AI-chained RCE bugs that bypass sandboxes on Windows
Security firm XBOW used AI agents to chain three Chrome bugs, earning a major bounty from Google for a remote code execution flaw.
Key points
- XBOW earned $250,000 from Google for chaining three unknown Chrome vulnerabilities using AI assistance.
- The exploit allowed remote code execution on Windows without user interaction, bypassing Chrome's sandboxes.
- Google has released patches for all three flaws in Chrome updates distributed in August and September.
Security researchers at XBOW used artificial intelligence to build a complex exploit chain against Google Chrome, earning a $250,000 bounty. The team, led by Brendan Dolan-Gavitt, utilized AI agents running OpenAI’s GPT-5.6 Sol model to identify and link three separate bugs. This combination allowed attackers to run code outside Chrome’s protective sandbox on Windows computers simply by loading a web page, requiring no clicks or downloads from the user.
In plain English
Chrome uses multiple layers of security to stop malicious code from harming your computer. One layer, called a sandbox, isolates web pages so they cannot access your files. Another layer handles crashes safely. The XBOW team found ways to break through both layers. They used a bug in Chrome’s JavaScript engine to escape the first sandbox. Then, they used a flaw in how Chrome handles animated images to break the second barrier. Finally, a third bug in the crash handler allowed them to execute arbitrary code on the system.
The background
XBOW stated on 13 October that it received the award for this full-chain exploit. The company noted it was the first such award under rules Google introduced in April 2026. The research team, which included Dolan-Gavitt, Andrés Luksenberg, Baul Lee, and Willem Pinckaers, began the project in early 2026. They built the successful chain between 2 and 7 August while attending security conferences in Las Vegas. The compute costs for the AI work totaled approximately $40,000, according to XBOW’s usage logs.
What changes now
Google has fixed all three vulnerabilities involved in the exploit chain. Patches were included in Chrome updates released on 25 August and 3 September, as reported by The Hacker News. XBOW confirmed that these bugs were never used against Chrome users in the wild before the fixes were applied. However, the company estimated that about one billion people running Chrome on Windows were exposed to this risk before the updates arrived. Google’s release notes for Chrome 152 credit Dolan-Gavitt for the Crashpad flaw, identified as CVE-2026-78952 and rated high severity.
Key terms explained
A sandbox is a security mechanism that isolates running programs to limit their access to system resources. When an application is sandboxed, it cannot easily read or write files outside its designated area. An exploit chain is a sequence of vulnerabilities used together to bypass multiple security controls. Attackers often need to chain bugs because a single flaw rarely provides full control over a system. Teams usually monitor vendor advisories closely to ensure all layers of protection are patched promptly, as unpatched components can undermine the security of the entire software stack.
What to do and how to stay safe: Google Chrome
- Verify that your Chrome browser is updated to the latest version to ensure you have the August and September security patches.
- Check your organization’s patch management policies to confirm that all Windows endpoints are receiving automatic browser updates without delay.
- Monitor internal logs for any unusual activity related to Chrome processes or crash handlers, as indicators of potential exploitation attempts.
- Review your web filtering rules to block access to untrusted sites that might host malicious payloads targeting known browser vulnerabilities.
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the AI build the exploit entirely on its own?
No, researchers chose the targets, supplied context, and decided which parts to join, applying human expertise to guide the AI agents.
Was this exploit being used by hackers before it was reported?
XBOW stated that the bugs were never used against Chrome users in the wild before the fixes were released.
How much did it cost to run the AI for this research?
XBOW estimated the compute cost at about $40,000 based on its usage logs during the six-day development period.
