XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days

The Internet’s most sacred rules have led us to believe that our safety is in our control. The best practice, we’ve always been told, is to be careful where you click: Never enter your personal information without confirming that a site is secure, download anything suspicious, or take any of the obvious phishing bait.

But what happens when simply visiting a website (something billions of people do dozens of times a day) is enough to expose every keystroke to a malicious actor? XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally, showing how an attacker could use Chrome to remotely take over a Windows machine. Earlier this year, it won our company a $250,000 bounty from Google, the first under its 2026 new rules. The bugs are now fixed, and today we’re sharing the details.

The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive. A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days.

The stakes

An attacker who seizes total control over a machine can monitor its user’s every move: reading their emails, their banking information, and their passwords, and seeing every detail about their personal, professional, and financial lives. Chrome is one of the most widely used tools on earth. It owns a solid majority of the global web browser market share, and more than half the world’s population relies on it. That means Google has had to make it one of the most hardened, well-defended pieces of software on the planet. The world’s best hackers have poked and prodded Chrome’s open-source code from every angle.

One of Chrome’s defenses is that it is built in layers. An attacker who finds a single bug could take over a web page, but that’s as far as they can go. They might pick the lock of a door that leads into a restricted area, but the doors out stay locked. A full chain is a set of bugs that, used together, open every door, from an ordinary web page to the computer itself.

How we did it

We started 2026 at an all-hands in Malta, where I issued a challenge to the team. We would build on our previous work creating offensive AI security researchers, which we’d done for web applications, but this time we’d do it for desktop software, servers, and IoT devices. We chose the hardest target we could think of — a full-chain exploit of Chrome — and an audacious timeline: the annual Black Hat cybersecurity conference in August.

Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge. You couldn’t name four better researchers, and we are fortunate to have them on our team.

These four were joined by a fifth colleague: OpenAI’s GPT-5.6 Sol and its predecessors. We deliberately picked a model that is available to anyone, not a specialized security model or one with restricted access. The compute we used over six days for the awarded chain cost $40,000, a fraction of the bounty.

Together, the team built a chain it thought would win. But when Google told us that it already knew about one of the bugs in the chain, we went back to the drawing board to build a new chain.

This project was the product of a partnership between humans and machines. The AI searched Chrome’s source code, tested ideas, built proofs of concept, and wrote the earliest drafts of the exploit. Our colleagues set the strategy, chose where to look, checked the agents’ work, and redirected the agents based on the initial results.

One human decision proved essential to get to the freshly awarded chain. The team wisely built the full-chain exploit as three independent parts, each with an alternative. That meant that if a bug had already been reported — precisely what had disqualified our first build attempt — we could quickly swap in a backup.

Then, while in Las Vegas for Black Hat and DEF CON, Brendan and the agents built the new exploit (drawing on the earlier experience) between Sunday, August 2, and Friday, August 7. Less than a week to do what used to take more than half a year. (If you’d like to read more about the three bugs that make up the chain, Brendan explains the technical details in a companion post.)

What happens next

This accomplishment belongs to both researchers’ judgment and agents’ speed. But we believe that within a year, each of the three bugs could be found by agents working on their own.

The cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike.

Many are asking whether we should restrict access to powerful models. The model we used is already public, so we believe that’s the wrong question.

None of this is cause for panic, but it is cause for urgency. The tools that found these bugs are available to anyone who defends software, and defenders have an advantage attackers never will: they can test their own code first. For the first time ever, defenders have access to the skills of attackers at the click of a button.

Steps to take today include: First, keep your Chrome browser current. All three bugs in our chain are fixed, and Google ships fixes like these quickly. Chrome installs updates on its own, but a fix only takes effect once you relaunch the browser, so when the Update button appears, restart it every time.

Second, assume your applications are exploitable and test your own software before someone else does. Plan for the attacks that get through anyway. No one will ever find every vulnerability. The cost of finding them is falling for both sides, so the right response is to find more of yours, sooner, while assuming some will still be missed.

XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product. If you’d like to be one of them, get in touch.