Xbow uses AI to chain 3 Chrome flaws, earns $250k bounty for Windows sandbox escape

Google has patched three zero-day vulnerabilities in the Chrome browser that security researchers chained together to execute code outside the browser’s sandbox on Windows machines. The fixes address flaws that Xbow researchers exploited to demonstrate a full system compromise.

What happened

Researchers at security startup Xbow discovered and chained three zero-day vulnerabilities in Chrome, creating an exploit capable of running code outside the browser’s sandbox on Windows systems, according to The Register. The team used OpenAI’s GPT-5.6-Sol model to assist in searching source code, testing hypotheses, and developing proof-of-concept stages for the attack.

Human researchers selected targets, provided context, and decided which components to chain, applying their own expertise to guide the AI agents, Brendan Dolan-Gavitt wrote in a technical writeup. The team spent six days during the Black Hat and DEF CON conferences building the exploit chain, incurring approximately $40,000 in token charges for the AI model usage.

Google fixed all three vulnerabilities and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit, according to The Register. Xbow estimates the vulnerabilities could affect about one billion users worldwide. CEO Oege de Moor noted that an intelligence agency veteran previously required six months to achieve similar access, whereas Xbow completed the task in six days.

Why it matters

The incident demonstrates how publicly available AI models can accelerate the discovery and chaining of complex browser vulnerabilities, significantly reducing the time required to build functional exploits. This shift compresses the window between vulnerability discovery and potential malicious use, increasing pressure on vendors to patch quickly.

The successful sandbox escape bypasses Chrome’s layered security barriers designed to contain compromised code and prevent takeover of the entire computer. The high bounty reflects the severity of full-chain exploits that allow arbitrary code execution outside the browser environment on widely used operating systems like Windows.

What to watch

• Monitor Google’s security advisories for confirmation of patch deployment across all Chrome versions.
• Track whether other browsers using the Chromium engine receive similar patches simultaneously.
• Watch for reports of wild exploitation attempts targeting unpatched Windows systems.
• Observe if AI-assisted discovery becomes a standard metric in vulnerability disclosure timelines.

Who needs to act first

Teams should prioritize updating Chrome on Windows systems exposed to untrusted web content, as these face the highest risk of sandbox escape attempts. Verify that all endpoints receive the latest stable release immediately after patch availability. Test the update in a controlled environment before broad deployment to ensure compatibility with internal tools. Ensure backup solutions are current before rolling out major browser updates to mitigate potential disruption.

What to do and how to stay safe: Google

• Force an immediate update to the latest stable version of Chrome on all Windows endpoints.
• Verify that automatic update settings are enabled and functioning correctly across the organization.
• Monitor system logs for unusual process executions that may indicate sandbox escape attempts.
• Educate users to report abnormal browser behavior or unexpected system permissions requests.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which operating systems are affected by these Chrome vulnerabilities?

The exploit chain demonstrated by Xbow researchers specifically targets Windows machines running the Chrome browser.

Did the researchers use any AI tools to find the bugs?

Yes, the team used OpenAI’s GPT-5.6-Sol model to help search code and develop exploit stages, guided by human researchers.

Has Google released a fix for these vulnerabilities?

Yes, Google fixed all three zero-day vulnerabilities and paid a $250,000 bounty for the discovery.