XBOW Labs research

Featured
Research

Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain

B. Dolan-Gavitt · Oct 13, 2026

The final chain combined a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. Together they turned JavaScript execution in an ordinary Chrome tab into code execution outside the renderer sandbox.

Brendan Dolan-GavittbyB. Dolan-Gavitt
Research feed

3 entries

Research01/03

How XBOW Found a Critical RCE in an EAC Voting Resource Calculator

byAriel Walter GarciaXBOW identified an unauthenticated, Critical-severity Remote Code Execution vulnerability in a public web application belonging to the U.S. Election Assistance Commission (EAC), the independent, bipartisan federal commission that focuses on election administration.Research02/03

No Time to Pwn: CVE-2026-72018

byBaul LeeXBOW found and exploited CVE-2026-72018, a Linux kernel bug human reviewers had passed over. The primitive looked too weak to matter, but it wasn't. Here's how a 16-byte write became root, and where autonomous research still needed a human call.Research03/03

Dead.Letter (CVE-2026-45185) How XBOW Found An Unauthenticated RCE On Exim

Federico KirschbaumbyF. Kirschbaum & A. LuksenbergXBOW discovered CVE-2026-45185, a critical unauthenticated RCE in Exim, and used the disclosure window to test how far human and autonomous exploit development could go.
Subscribe

Get XBOW Labs updates in your inbox

Subscribe to XBOW Labs and get occasional emails featuring our latest research, technical write-ups, event recordings, webinars, and talks—delivered only when we have something worth sharing.