AI agent weaponizes live Chrome 0-day exploits autonomously in under 24 hours
cyb3rops · x · 2026-09-06
Developer @lordx64 shows how CyberKimi, an agent trained on Kimi, hunts Chrome bugs by starting from unpatched n-days. From a Sep 2 main-branch fix diff, the team caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug — both still live in every shipping Chrome stable, with no CVE published, meaning users are unprotected.
The exploit was weaponized autonomously in under 24 hours across three stages:
- Stage 1: deterministic LLE forge (bug 554421904)
- Stage 2: cage-escape prep — composing caged RW into sandbox-wide RW via a forged BigUint64Array external pointer, plus runtime binary-base leak to defeat ASLR without baked offsets
- Stage 3: PC control via a RegExp calling-convention desync, landing on a fully controlled string, then a JOP chain ending in a tail-call to system()
A landmark demo of autonomous agent-driven vuln research — and real threat intel for Chrome stable users.
More from coding & agent
- 105 Real Bugs Tested: GPT-6.1 Sol Over 10x Cheaper Than GPT-5.6 Sol — PawelHuryn · 2026-10-23
- Dev builds SkiFree-style sled game in one prompt, praises DeepSeek Flash — victormustar · 2026-10-23
- Every ditched personal agents for a shared Claude Managed Agents coworker in one week — every · 2026-10-23
- WorkOS shows how to let AI agents safely sign up for your app with auth.md and ID-JAG — AI Engineer · 2026-10-23
- Devs on Reddit swap tactics for stopping prompt regressions in AI agents — SleepFlimsy6963 · 2026-10-23
- Claude Code + ComfyUI MCP workflow for client work: paid models or open weights? — newaccount47 · 2026-10-23