XBOW Details Chrome Full-Chain Exploit: 3 Bugs, 6 Days, $250K Google Bounty
moyix · x · 2026-10-13
XBOW detailed its Chrome full-chain exploit — a V8 compiler bug, an animated-WebP decoder bug for V8 sandbox escape, and a Crashpad memory-safety bug for renderer escape — earning Google's first $250K Chrome full-chain bounty under the April 2026 VRP rules. Pre-LLM full chains took a 4-person team 6-9 months; XBOW's awarded chain took 6 days, built via parallel agent campaigns (gpt-5.6-sol) with researchers directing target selection and integration, with clean per-stage interfaces and backup routes.
Related event: XBOW's AI Builds Full Chrome Exploit Chain in Six Days for $250K Bounty(3 posts)→
More from coding & agent
- Scuba emerges from stealth with $34M to build shared context engine for teams and agents — Scobleizer · 2026-10-14
- Connect Claude Code to NotebookLM via MCP to read full docs without burning tokens — Aiden_Tech_Ai · 2026-10-14
- SeedAudio 1.5 teased: AI-generated audio joins the video editing workflow in CapCut — FellMentKE · 2026-10-14
- How I built a 7-agent social media team for a legal consultant client — ifioknkem · 2026-10-14
- Pydantic's Samuel Colvin: Graph libraries are a mistake, your code IS the graph — samuelcolvin · 2026-10-14
- Sentience ships a web app built fully autonomously by agents while its human was on vacation — ditzikow · 2026-10-14