XBOW Earned $250,000 for Finding Chrome Vulnerability Chain
The research team successfully chained three browser bugs to execute code outside the security sandbox.
Updated on Oct. 13, 2026 in Cybersecurity
Live Poll
Do you trust that AI-assisted security research makes the software you use daily more secure?
Security researchers at XBOW have received a $250,000 payout from Google after identifying a vulnerability chain that affected approximately one billion Chrome users on Windows. Google has already shipped security patches to resolve the three bugs involved in the exploit.
Why it matters
This research highlights how AI-assisted exploitation can effectively map complex attack surfaces, prompting faster security responses from major browser vendors. The project illustrates the high-stakes economics of vulnerability research, where discovery costs are significantly lower than potential exploit damages.
The exploit successfully chained three vulnerabilities, including a memory control bug in the V8 engine and two secondary flaws in the animated-WebP decoder and Crashpad, to bypass the Chrome security sandbox.
The players
XBOW
A research group focused on identifying software vulnerabilities through AI-assisted analysis.
The technology corporation that maintains the Chrome browser and operates the Chrome Vulnerability Reward Program.
The details
XBOW utilized a single security researcher paired with AI agents to develop the exploit over six days. The process involved identifying flaws in the V8 engine—the browser component responsible for executing JavaScript—to gain initial memory control. By subsequently leveraging flaws in the animated-WebP decoder and the Crashpad diagnostic tool, the team demonstrated a complete sandbox escape, allowing for unauthorized code execution.
Timeline
October 2026: XBOW announced the award from Google.
The Tech Race
This payout follows the established trajectory of Google's bug bounty program, which incentivizes external security researchers to identify critical browser exploits before they are utilized by malicious actors. The successful development of this chain via AI agents underscores a shift in how efficiently researchers can now stress-test browser architecture.
Users running Chrome on Windows are protected because Google has already shipped the necessary security fixes for these vulnerabilities. No further user action is required beyond ensuring the browser is updated to the latest version.
The takeaway
The event confirms that AI-assisted research can now reliably chain multiple vulnerabilities that were previously difficult to isolate. Interested observers should monitor the future output of the Chrome Vulnerability Reward Program to see if this $250,000 payout marks a trend in higher average rewards for complex exploit chains.
Further reading
For more on how browser security is maintained against modern exploits, visit Cybersecurity.
Live Poll
Do you trust that AI-assisted security research makes the software you use daily more secure?
