TLDR Tech / Practical
XBOW Labs Crafted Chrome Exploit in Six Days Using AI Agents
XBOW Labs researchers developed a complete Chrome exploit in just six days by employing parallel AI agent campaigns. This achievement led to Google's first $250,000 reward under the April 2026 Chrome full-chain vulnerability reward program rules. The exploit successfully combined a V8 compiler flaw in Maglev, an animated-WebP decoder vulnerability enabling a V8 sandbox escape, and a memory-safety issue within Crashpad to achieve arbitrary code execution outside the renderer sandbox. The report elaborates on the fundamental cause of each vulnerability, the connections between them, and the adaptable design approach that permitted researchers to substitute a redundant V8 escape during the campaign.
Read the full story