Update Chrome to patch AI-discovered exploit chain found by Xbow researchers

Researchers from Xbow USA discovered a chain of vulnerabilities in Google Chrome that could have allowed control over one billion Windows machines. The team spent six days developing the exploit, which earned them a $250,000 bug bounty from Google.

What happened

Xbow USA researchers utilized $40,000 worth of AI compute time to identify and chain multiple flaws in Google’s Chrome browser, according to Computerworld. The team worked for six days to develop the exploit, marking the first bounty awarded under Google’s new 2026 rules. They chose OpenAI’s GPT-5.6 Sol to demonstrate the capabilities of a publicly available model rather than a specialized security tool. The researchers used the AI to search Chrome’s source code, test ideas, and build proofs of concept while they set the strategy and verified the work.

Why it matters

Understanding this incident requires grasping how browser sandboxes work. Browsers use sandboxes to isolate web content from the operating system, preventing malicious code from harming the computer. In this case, the researchers chained vulnerabilities to escape the V8 JavaScript engine sandbox and then the operating-system process sandbox. This allowed them to launch a Windows application directly from a malicious web page, bypassing standard security controls.

The fix

• Install the latest update for Google Chrome immediately to patch the chained vulnerabilities.
• Verify that your browser is running the most recent version by checking the "About Chrome" section.
• Ensure automatic updates are enabled so future security patches are applied without manual intervention.
• Review your browser extensions and remove any that are unnecessary or from untrusted sources.

Why it matters

When researchers demonstrate how to chain vulnerabilities, it highlights the importance of defense-in-depth strategies. Teams should assume that single-layer protections can be bypassed if multiple flaws exist. Check whether your organization monitors for exploit chains rather than just individual bugs. Regularly review how applications interact with the operating system to ensure isolation boundaries remain effective. This approach helps identify weaknesses before malicious actors can exploit them in the wild.

Background: Bug bounty programs

Bug bounty programs reward independent researchers for finding and reporting security flaws in public systems. Companies define scope, researchers submit proofs of concept, and triage teams verify impact. This model scales coverage but fails to catch deep architectural issues or business logic errors that require specific context or multi-step exploitation sequences.

Read the full guide: How Bug Bounty Programs Work: Mechanisms, Limits and Behind-the-Scenes Reality

What to do and how to stay safe: Google Chrome

• Update your web browser to the latest version to ensure you have the most recent security patches.
• Enable automatic updates for your operating system and applications to reduce exposure to known flaws.
• Monitor your browser’s console logs for unusual activity that might indicate an attempt to escape sandbox restrictions.
• Educate users about the risks of visiting untrusted websites and downloading unknown files.

Step-by-step guide: What is password policies and how they protect systems

General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much did it cost Xbow to find the Chrome vulnerabilities?

The researchers spent $40,000 on AI compute time to discover and develop the exploit chain.

What AI model did Xbow use to find the flaws?

They used OpenAI’s GPT-5.6 Sol to search source code and build proofs of concept.

Did Google fix the vulnerabilities found by Xbow?

Yes, Google fixed the flaws after Xbow presented its findings to the company.