Google pays $250,000 to XBOW for AI-driven Chrome exploit

Security researchers at XBOW successfully used artificial intelligence to discover and exploit a full-chain vulnerability in Google Chrome, earning a $250,000 reward from Google’s Bug Bounty program.

Using AI agents, the team was able to chain three separate vulnerabilities to bypass the browser’s sandbox and achieve arbitrary code execution on a Windows system. The process, which took only six days, involved using AI to analyze thousands of lines of code, test hypotheses, and identify memory leaks. XBOW estimates that a similar manual investigation by four specialists would have typically required six to nine months of work.

The exploit chain involved the V8 JavaScript engine's Maglev compiler and mechanisms to escape the browser's isolation. Google has since patched these vulnerabilities, and users on Chrome version 153 or later are protected.