Xbow chains three Chrome zero-days with GPT-5.6 Sol into a sandbox-escape exploit for Windows; Google pays $250K bounty
Researchers at AI pen-testing startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Google Chrome into a full-chain exploit that executes code outside the browser sandbox on Windows. Xbow estimates about one billion users could be affected. Google fixed all three flaws and paid a $250,000 bounty, its top reward for a Chrome full-chain exploit. The team of four researchers needed only six days, spread across Black Hat and DEF CON, and roughly $40,000 in token costs. The article does not report in-the-wild exploitation.
Technical Details
- The chain crosses two security boundaries: the V8 sandbox and the outer OS process sandbox.
- Stage 1: a bug in Maglev, V8's mid-tier optimizing compiler, caused by a reused, mutable boxed number during deoptimization. It gives read/write access across V8's pointer-compression cage.
- Stage 2: an animated-WebP decoder bug acts as a V8 sandbox escape. It abuses a property the V8 sandbox deliberately does not enforce and that Blink wrongly assumed it could trust.
- Stage 3: an overflow (memory-safety bug) in Crashpad crosses the outer process boundary and gives unsandboxed code execution on the host.
- AI agents searched source code, tested hypotheses and built proofs of concept and exploit stages. Humans chose targets, supplied context, challenged results and decided how to chain the components.
- The article gives no CVE identifiers.
Remediation
- Update Chrome to version 152.0.7977.82 or later.
- Chrome updates itself, but the fix only takes effect after the browser is relaunched, so enforce restarts.
- Researchers warn that LLMs lower the bar for building full-chain browser exploits, so defenders should shorten patch cycles.
Linha do tempo
-
Xbow chains three Chrome zero-days with GPT-5.6 Sol into a sandbox-escape exploit for Windows; Google pays $250K bounty
ler a análise desta fonte ocultar
Researchers at AI pen-testing startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Google Chrome into a full-chain exploit that executes code outside the browser sandbox on Windows. Xbow estimates about one billion users could be affected. Google fixed all three flaws and paid a $250,000 bounty, its top reward for a Chrome full-chain exploit. The team of four researchers needed only six days, spread across Black Hat and DEF CON, and roughly $40,000 in token costs. The article does not report in-the-wild exploitation.
Technical Details
- The chain crosses two security boundaries: the V8 sandbox and the outer OS process sandbox.
- Stage 1: a bug in Maglev, V8's mid-tier optimizing compiler, caused by a reused, mutable boxed number during deoptimization. It gives read/write access across V8's pointer-compression cage.
- Stage 2: an animated-WebP decoder bug acts as a V8 sandbox escape. It abuses a property the V8 sandbox deliberately does not enforce and that Blink wrongly assumed it could trust.
- Stage 3: an overflow (memory-safety bug) in Crashpad crosses the outer process boundary and gives unsandboxed code execution on the host.
- AI agents searched source code, tested hypotheses and built proofs of concept and exploit stages. Humans chose targets, supplied context, challenged results and decided how to chain the components.
- The article gives no CVE identifiers.
Remediation
- Update Chrome to version 152.0.7977.82 or later.
- Chrome updates itself, but the fix only takes effect after the browser is relaunched, so enforce restarts.
- Researchers warn that LLMs lower the bar for building full-chain browser exploits, so defenders should shorten patch cycles.