From Six Months to Six Days: GPT-5.6 Sol Built the $250,000 Chrome Exploit

On August 2, 2026, during Black Hat and DEF CON in Las Vegas, the XBOW team launched a six-day run with a public AI model. By August 7, they held a full-chain exploit chain for Google Chrome that traversed both sandboxes and executed code on Windows. Google confirmed the three zero-day bugs, patched them, and paid the maximum bounty of $250,000. The API cost: roughly $40,000.

How the Chain Works: V8, WebP, and the Final Step on Windows

The first link is CVE-2026-85045, a race condition in Chrome's V8 JavaScript engine. The official CVE record confirms the bug's nature and the fixed version: Chrome 152.0.7977.82, released September 3, 2026. The primary source assigns this CVE to the V8 bug, explicitly noting that XBOW had initially indicated a different assignment: a discrepancy the dossier records as a research team error.

The second link sits in the animated WebP decoder, Google's image format. No confirmed public CVE identifier emerges for this component. The third link is CVE-2026-78952, a bug in the Crashpad crash handler, fixed in Chrome 152.0.7977.65 on August 25, 2026. Chaining these three flaws allowed an escape from the V8 sandbox, then the renderer sandbox, and finally native code execution on the underlying operating system.

The attack required no user interaction beyond loading the web page. This characteristic places it in the drive-by exploit category, among the most dangerous for mass attack surface.

The Numbers That Redraw Offensive Research Timelines

The time compression is the figure that upends conventional parameters. According to XBOW's Brendan Dolan-Gavitt, before large language models a Chrome full chain took a team of four around 6-9 months. The same team's first AI-assisted attempt took two months. The award-winning result dropped to six days.

The operational cost is equally revolutionary. XBOW founder Oege de Moor quantified the API fees for the entire six-day run at roughly $40,000. The figure is below the $250,000 bounty reward, and infinitely lower than the traditional cost of a specialized research team for months. This cost-to-return ratio shifts vulnerability research investment from scarce human capital to scalable operational capital.

"Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days" — Brendan Dolan-Gavitt, XBOW

Bounty Rules and the 2026 Context

The $250,000 payment represents the maximum tier of the Chrome Vulnerability Reward Program for full-chain exploits. In 2026, Google updated the program rules: this bounty level is awarded a maximum of four times per year. According to CryptoBriefing, this is the first such award in 2026 and only the second in the program's history.

XBOW stated the three bugs were never used in attacks against Chrome users before disclosure. Google responded with two separate patch releases: Crashpad first on August 25, then V8 on September 3. The WebP bug, lacking a public identifier, has no documented fix date in the CVE record.

Why It Matters

The dossier does not specify the API access tier required to replicate XBOW's run: GPT-5.6 Sol is publicly available, but it remains uncertain whether the general public or only specific developer tiers can sustain compute loads of this magnitude. The source documents neither other cases of AI-assisted full-chain exploits nor the exact decision-making role of human supervision in target selection and proof-of-concept validation.

The dossier lists no specific remedial measures beyond updating to patched Chrome versions. It also does not indicate whether the chain would have worked on platforms other than Windows. These gaps leave open questions about the method's replicability and systemic reach.

What the brief documents is sufficient to trace a structural shift. When roughly $40,000 in compute and six days produce an exploit worth $250,000 that previously required months of specialist work, the constraint is no longer human expertise but API access and operational capital. The defenders' protection window shrinks proportionally.

Sources

• https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html
• https://blog.netmanageit.com/researchers-used-a-public-openai-model-to-build-a-250-000-chrome-full-chain-exploit-in-six-days/
• https://cryptobriefing.com/xbow-gpt-5-6-chrome-exploit-bounty/
• https://www.cve.org/CVERecord?id=CVE-2026-85045
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/search/label/Vulnerability

Information verified against cited sources and current as of publication.

Sources