AI-powered security agents developed a Google Chrome exploit within six days and earned XBOW company $250,000 from Google. The exploit involved an intricate chain of attacks that used to require extensive manual work and unique expertise in the past.
Researchers at XBOW utilized OpenAI’s publicly available GPT-5.6 Sol model to find and combine three Chrome vulnerabilities, resulting in an exploit that enables code execution in Chrome when a victim loads a web page. The researcher group spent nearly $40,000 on the AI-powered process, in addition to the extensive preparations before the six-day research window.
V8 JavaScript Engine, WebP image codec, and Crashpad constitute Google Chrome’s fundamental components.
The researchers discovered an intricate attack chain that involved all three elements. Exploiting Chrome’s reporting tool, one could gain arbitrary code execution by inducing the component into a special state.
The researchers found two zero-day flaws in Chrome, namely,CVE-2026-85045 and CVE-2026-78952. Google patched the flaws in Chrome on August 25 and September 3, respectively. The software received updates in versions 152.0.7977.65 and 152.0.7977.82.
If you are a Windows user, you need to restart Chrome and ensure it is at least version 152.0.7977.82.
It is unclear whether any attackers used the Chrome flaw to infiltrate systems. However, Chrome is a popular browser with an estimated billion Windows users worldwide, any successful attack would have severe consequences.
The article concludes by emphasizing the collaboration between AI-powered agents and human counterparts. Apparently, the AI-powered system did not do everything automatically.
In addition to the preparatory steps, the researchers engaged in the preparatory steps and the exploit development itself. Thus, the new possibilities opened up by AI research tools is that researchers are no longer limited by their knowledge and skills to develop an intricate attack chain.
Google Vulnerability Reward Program encourages security researchers to report bugs they discover in the company’s products.
In this particular case, XBOW received $250,000 from Google for the research.
The result highlights the relevance of browser security research and the significance of the work of security researchers who protect users from attacks. On the one hand, the researchers increased the potential attack surface of Chrome.
However, the exploit they discovered is chained in a way that allows Chrome users to protect themselves better.
The new possibilities in security research, enabled by artificial intelligence, change the game for browsers’ security. Attackers can develop sophisticated exploits faster now, and the protection-focused counterparts should respond by promptly distributing and installing updates.
Read the original article: