Ethical Hacking News
Breakthrough in Browser Security: A team of researchers from the security firm XBOW successfully built a $250,000 Chrome full-chain exploit in six days, utilizing a public OpenAI model, in a significant milestone in the field of browser security.
A team of researchers from XBOW successfully built a $250,000 Chrome full-chain exploit in six days, utilizing a public OpenAI model.The attack chained three previously unknown Google Chrome bugs into a single attack, breaching every layer of Chrome's protection.The researchers used AI agents running OpenAI's GPT-5.6 Sol model to efficiently build the attack, completing it in just six days.Google has since confirmed all three bugs and fixed them, awarding XBOW the top $250,000 reward for a full Chrome exploit.The attack had the potential to put an estimated 1 billion people running Chrome on Windows at risk, highlighting the pressing need for enhanced browser security measures.
The world of cybersecurity has witnessed numerous breakthroughs in recent times, with researchers continually pushing the boundaries of what is thought to be possible. A recent development in the field of browser security has garnered significant attention, as a team of researchers from the security firm XBOW successfully built a $250,000 Chrome full-chain exploit in a span of six days, utilizing a public OpenAI model. This remarkable achievement not only highlights the capabilities of AI in solving complex problems but also underscores the pressing need for enhanced browser security measures.
The project, which was spearheaded by XBOW's researchers, involved chaining three previously unknown Google Chrome bugs into a single attack. This attack, when executed, ran code on a Windows computer without the need for the user to click or download anything. The attack's complexity was such that it breached every layer of Chrome's protection, from the web page all the way to the computer. The researchers' use of AI agents running OpenAI's publicly available GPT-5.6 Sol model enabled them to efficiently build the attack, with the AI agents performing tasks such as searching Chrome's source code, testing ideas, building proofs of concept, and writing the first drafts of the exploit.
The attack's construction was a result of the researchers' months-long preparation, which began with a January staff meeting in Malta. The team's efforts culminated in a successful build of the Chrome full-chain exploit, which was completed in just six days. This achievement is particularly noteworthy, as it demonstrates the speed and efficiency with which AI can be utilized to solve complex problems. The researchers' use of the AI model allowed them to produce a full-chain Chrome exploit that would have taken a team of four around six to nine months to accomplish.
The attack itself was comprised of three bugs, each of which played a crucial role in the exploit's success. The first bug gave the attacker control of memory inside Chrome's JavaScript engine, while the second bug used that control to break out of the engine's inner sandbox and make a precise write to the computer's memory. The third bug, located in Chrome's crash handler, turned that single write into full code execution on the machine. The identified bugs are rated high severity and require the user to load a page.
Following the completion of the attack, Google has since confirmed all three bugs and has fixed them. XBOW, the security firm behind the attack, was awarded the top $250,000 reward for a full Chrome exploit under Google's Chrome Vulnerability Reward Program. The program, which was updated in 2026, pays up to $250,000 for a full-chain exploit, the most it offers for a single report, under rules it updated in 2026.
The researchers behind the attack, including Brendan Dolan-Gavitt, noted that the achievement marked a significant milestone in the field of browser security. Dolan-Gavitt wrote, "Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days." This statement highlights the significant speedup in exploit development facilitated by the use of AI models.
The significance of the $250,000 Chrome full-chain exploit cannot be overstated. The attack had the potential to put an estimated 1 billion people running Chrome on Windows at risk of this kind of attack, according to the company. The attack's breaching of Chrome's protection mechanisms, which are designed to safeguard users' data, underscores the pressing need for enhanced browser security measures.
XBOW's point is the speed at which the attack was built, with an estimated $40,000 in AI charges spread across six days. The company's founder, Oege de Moor, noted that the achievement marked a significant milestone in the field of browser security, with the bar being lowered for defenders. Dolan-Gavitt added, "Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!" The researchers' warning for defenders is clear: the bar has been lowered, and defenders must adapt accordingly.
The achievement of building a $250,000 Chrome full-chain exploit highlights the rapid progress being made in the field of AI and its applications in cybersecurity. The development of AI models that can efficiently solve complex problems has significant implications for the field of cybersecurity, and researchers continue to push the boundaries of what is possible.
The significance of this achievement extends beyond the realm of browser security, as it highlights the potential of AI in accelerating the development of complex exploits. The development of AI models that can efficiently solve complex problems has significant implications for the field of cybersecurity, and researchers continue to push the boundaries of what is possible.
In conclusion, the $250,000 Chrome full-chain exploit marks a significant milestone in the field of browser security. The achievement highlights the capabilities of AI in solving complex problems and underscores the pressing need for enhanced browser security measures. The development of AI models that can efficiently solve complex problems has significant implications for the field of cybersecurity, and researchers continue to push the boundaries of what is possible.
Related Information:
https://www.ethicalhackingnews.com/articles/Breakthrough-in-Browser-Security-Unveiling-the-250000-Chrome-Full-Chain-Exploit-ehn.shtml
https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html
Published: Wed Oct 14 07:29:19 2026 by llama3.2 3B Q4_K_M
