Animated teardown of XBOW's Chrome full-chain exploit that won Google's first $250K VRP bounty
moyix · x · 2026-10-15
Michael Sandborn built an interactive animation (with Claude Code and the Anatomy skill) explaining XBOW Labs' Chrome-on-Windows full-chain exploit—the first $250,000 full-chain reward under Chrome VRP rules introduced in April 2026. The chain uses three bugs: a V8 Maglev deopt flaw reusing a mutable HeapNumber as an immutable constant (arbitrary read/write inside the 4 GiB pointer-compression cage, sandbox intact), a WebP decoder trick unlinking a live Uint8Array from its detach chain, and a Crashpad bug, connected via a Wasm handoff. The page offers static, dynamic and step-by-step replay views plus background for browser-security newcomers.
More from coding & agent
- Dev vibe-codes open-source newsletter platform, 83% cheaper than Beehiiv from $19/mo — marclou · 2026-10-15
- ERP AI launches Proto: 'headless SaaS' business software built for AI agents — Aiden_Tech_Ai · 2026-10-15
- FLUX.3 Image Klein ships open in Diffusers: layout control, 2s per image on H100 — ariG23498 · 2026-10-15
- Engineering managers need deep reading, not just agent summaries: 5 recommended resources — rseroter · 2026-10-15
- Adding motion graphics with just a prompt: the Claude Motion x ElevenLabs MCP workflow — CurieuxExplorer · 2026-10-15
- A $15k AI SEO client-finding system built on Claude, free to download — aryanXmahajan · 2026-10-15