XBOW chained three Chrome bugs into a full exploit in 6 days, winning Google's first $250K full-chain bounty
moyix · x · 2026-10-14
XBOW details how it built a Chrome full-chain exploit in just six days, claiming Google's first $250,000 full-chain reward under the April 2026 VRP rules, affecting an estimated 1 billion users. The chain combined a V8 compiler bug, an animated-WebP decoder bug, and a Crashpad memory-safety bug to escape the renderer sandbox. Pre-LLM full chains took teams 6–9 months; XBOW's agents (running gpt-5.6-sol) ran parallel campaigns for search, memory corruption, and sandbox escapes while researchers picked targets and integrated components, with clean interfaces and backup routes per stage.
More from coding & agent
- Yell at your computer, it files tickets and implements them: ZergBoard demo goes public — idanbeck · 2026-10-14
- A deliberately lo-fi Counter-Strike 1.6 clone ships with a live ZergBoard backlog — idanbeck · 2026-10-14
- ZergBoard: yell requirements at the machine, agents auto-implement the tickets — idanbeck · 2026-10-14
- LlamaForge: a browser panel for upstream llama.cpp with local agents that must quote their sources — Sleepybear2611 · 2026-10-14
- One auto-research.md prompt sent this repo's PRs exponential — agent-driven contribution sprint — IgorCarron · 2026-10-14
- Austin LangChain talk: Neo4j and TigerGraph are far faster now, but entity graphs still beat embedding piles — colinmcnamara · 2026-10-14