Whitepaper
Google’s first $250,000 full chain Chrome award under the 2026 rules went to an autonomous platform. The research, and what it means for how often you test.
| Inside | |
|---|---|
| 01 | How three vulnerabilities in V8, the WebP decoder and Crashpad were chained into a full Chrome compromise in six days, for about $40,000 in model time. |
| 02 | Why the bar for a Chrome full chain fell from six to nine months to six days, and what that means for applications nowhere near as hardened. |
| 03 | Eight questions to ask about how your applications are tested, and the evidence a finding should carry before it interrupts an engineer. |
We email the PDF. Anything else we send, you can stop in one click.
“Six days and $40,000 is not a lot of time or money when the payoff is a full chain attack on Chrome... it does mean the bar is significantly lower. Defend accordingly.”
- Scope you set.
- Every action logged.
- Production safe validation.